Users of Apple’s Safari browser on Windows may be resting easier now that a new release of the software fixes a month-old vulnerability that could have left users open to a so-called “carpet bomb” attack.
While the new Apple Safari 3.1.2 Web browser for Windows fixes a handful of problems, the most notable improvement targets the vulnerability first publicly disclosed by security researcher Nitesh Dhanjani on May 15.
At the time, Dhanjani said Safari allowed a malicious Web site to “carpet bomb” a user’s default download directory with a deluge of resource downloads for which a user has not provided consent.
Two weeks after Dhanjani published the finding, Microsoft issued its own advisory, warning Windows users against the potential threat of these files being automatically executed when a user also has Internet Explorer installed.
Apple also suggested a Microsoft technology worsened the problem.
“An issue exists in how the Windows desktop handles executables,” Apple wrote in its Safari 3.1.2 security update notes. “Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code.”
The fix that Apple had to perform to fix the issue seems relatively straightforward and obvious, however.
“To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file,” Apple stated. “Also, the default download location is changed to the user’s Downloads folder on Windows Vista, and to the user’s Documents folder on Windows XP.”
Safari users on the Mac are not at risk from the same flaw, according to Apple. Neither Apple nor Microsoft were immediately available for comment.
In addition to tackling the carpet bombing issue, the patch also addresses several other vulnerabilities.
Safari 3.1.2 for Windows provides a fix for an issue that could be triggered if a user views a maliciously designed GIF or BMP image. Apple described the flaw as a memory-read error that could lead to the disclosure of memory contents.
There is also a fix of Safari’s core rendering engine, WebKit, to protect users against a memory corruption issue resulting from its handling of JavaScript arrays.
“Visiting a maliciously crafted Web site may lead to an unexpected application termination or arbitrary code execution,” Apple said. “This update addresses the issue through improved bounds checking.”
Apple’s Safari browser has been available on Windows since last June. The Safari 3.1 browser debuted in March with Apple claiming it was the fastest browser yet. Earlier this week, Mozilla released its own challenge to Apple’s claims with the Firefox 3 browser.
