Safari For Windows: Six Security Exploits In One Afternoon
Back when the iPhone launched, we wondered if Apple would release a version of Safari for Windows and now that Apple has in fact done that, Cult of Mac’s Leander Kahney echoes many commenters’ thoughts in that initial post: Who in Their Right Mind Would Run Safari on Windows? As it turns out there’s an easy answer: Hackers. It took all of two hours for researchers to find 6 bugs in the Windows version of Safari, 4 DoS attacks and 2 remote code execution bugs.
Now granted, Safari is a beta and some bugs are to be expected, but six in one afternoon does not bode well for Apple’s second foray into Windows software.
While one of the bugs comes from a security consulting company who will not divulge the details until Apple has sufficient time to patch the flaws, Thor Larholm, a Danish hacker, has detailed the workings behind one of the remote code injection flaws.
To be fair the exploit is not entirely Safari’s fault since it leverages some Windows vulnerabilities to do its dirty work, but most of the blame can go to Safari for failing to properly validate URL arguments before passing them on to the command line.
Still, six exploits in two hours doesn’t exactly make you want to rush out and download a copy does it?
