Apple Issues Windows Safari Bug Fixes
Apple today issued software updates to fix at least three security vulnerabilities in the new version of the Safari Web browser, designed for Windows PCs.
The fixes are available in a new version of the browser, Safari 3.0.1 Public Beta for Windows, available at this link, or via the Apple Software Update application bundled with versions of QuickTime and iTunes for Windows. Apple says none of these flaws introduce security holes in Mac OS X versions of the browser.
The updates come less than four days after the company released Safari for Windows. Within hours of the browser's initial release, security researchers began pounding it with "fuzzer" programs, which are free tools designed to rapidly find security holes in software.
Altogether, three different researchers claimed to have found a total of eight security holes, though Apple's security advisory doesn't credit any researchers in particular.
It should be stressed that companies often release software in beta form as an invitation to let their user communities contribute to ironing out bugs. As a result, I would expect to see several more updates in quick succession. So unless you're a developer or simply dying to use Safari on Windows, it may be simpler (and safer) in the longer run to wait for Apple to push out a final release of the program.
By Brian Krebs |
June 14, 2007; 10:15 AM ET
Misc.
,
New Patches
,
Safety Tips
Previous: FBI Unveils Movable Feast with 'Operation Bot Roast' |
Next: House Approves Anti-Caller ID Spoofing Bill
Posted by: Vincent | June 14, 2007 10:24 AM
I love anything new, and so had a go downloading that Safari for Windows, and it probably was because it was in beta, but nothing worked, I couldn't even change the home page or anything, and none of my bookmarks from Firefox would import. AND as soon as I removed it, I ran all my ant-virus programs and Avast! anti-virus discovered a trojan that was damned hard to get rid of. The motto: If you're a bit of a technophobe, stay away from beta!
Posted by: Sarah | June 14, 2007 10:28 AM
Heya
I loved it,it is simply beautiful and works..
I love especially the OPEN ALL TABS,it is so simple,almost akin to Opera Sessions.
As for BUgs,i have bot a firewall and antivirus plus i am a secured netwrok with firewall.So i guess is hould be safe..but crossing fingers.
the interface is just gorgeous and the words and pictures are amazing,,
Posted by: Zul | June 14, 2007 11:04 AM
The tear-off tab functionality is quite excellent, even in its Windows implementation. It is the first new UI trick that I have really fallen in love with since Expose was added to Mac OS 10.3.
Posted by: Nick | June 14, 2007 11:34 AM
Hey, I love Safari 3 for Windows.
I know people complained about font rendering and other stuff but I absolutely love its speed and other goodies like Ctrl-F to find words in a web page, as well as resizing textboxes like the one I am typing this comment right now.
It's not perfect but what dya expect? It's still BETA but still I prefer it to IE and FF. Can't wait to get the final version coming soon when Leopard gets its spots.
Posted by: Romy | June 14, 2007 11:35 AM
Safari works well for me so far, and seems pretty fast.
Posted by: Mike | June 14, 2007 11:44 AM
Ctrl-F works for all browsers doesn't it? Has been for a long time.
Posted by: Tri | June 14, 2007 12:19 PM
Doesn't seem to be any quicker than IE or FF. No really good features that the others don't have. Crashes a lot.
Posted by: john | June 14, 2007 12:56 PM
I think its great that all these security researchers are "targeting" Safari. It will only make the final release more secure - the whole point of beta testing. But from what I've been reading, the bugs are popping up because these researchers are really annoyed with Apple's security arrogance. So they're specifically targeting Safari and refusing to inform Apple prior to publicly posting the bugs.
If they really want to embarrass Apple, they shouldn't waste their time on lame Safari bugs; they should focus they're time on developing the same type exploits (malware) that infect Windows everyday. Until they make a real dent in OSX's armor, they're only strengthening Apple's security argument and most likely its arrogance.
Moreover, by specifically targeting Apple, they're now invalidating the "security through obscurity" excuse used by Microsoft proponents to explain why Apple is essentially immune to malware. You can't have a bunch of PO'd security researchers pounding Apple's products and at the same time claim that they're only safe because nobody cares about creating exploits for a product with a single digit market share.
BTW, I'm a Windows XP user and one of the many security apps I use is Spy Sweeper, which now states "Your currently protected from 174,388 threats" - none of which affect Mac OSX. That said, it seems like Apple has a d*mn good reason for being arrogant.
Posted by: Tom R | June 14, 2007 2:44 PM
The control-F search in Safari dims the page and highlights the hit in an orange box. Really makes it stand out on a page; I'm frequently looking all over a page in other browsers trying to find the hit.
Posted by: Vic | June 14, 2007 2:50 PM
"Apple says none of these flaws introduce security holes in Mac OS X versions of the browser."
They do...
CVE-ID: CVE-2007-3186
Available for: Windows XP or Vista
Impact: Visiting a malicious website may lead to arbitrary code execution
Description: A command injection vulnerability exists in the Windows version of Safari 3 Public Beta. By enticing a user to visit a maliciously crafted web page, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional processing and validation of URLs.
This does not pose a security issue on Mac OS X systems, but could lead to an unexpected termination of the Safari browser.
CVE-ID: CVE-2007-3185
Available for: Windows XP or Vista
Impact: Visiting a malicious website may lead to an unexpected application termination or arbitrary code execution
Description: An out-of-bounds memory read issue in Safari 3 Public Beta for Windows may lead to an unexpected application termination or arbitrary code execution when visiting a malicious website. This issue does not affect Mac OS X systems.
CVE-ID: CVE-2007-2391
Available for: Windows XP or Vista
Impact: Visiting a malicious website may allow cross-site scripting
Description: A race condition in Safari 3 Public Beta for Windows may allow cross site scripting. Visiting a maliciously crafted web page may allow access to JavaScript objects or the execution of arbitrary JavaScript in the context of another web page. This issue does not affect Mac OS X systems.
Posted by: me | June 14, 2007 2:56 PM
Regarding the CVE's posted by "me": Read the CVE's. At the bottom of 3185 and 2391, "This issue does not affect Mac OS X systems."
At the bottom of 3186, "This does not pose a security issue on Mac OS X systems, but could lead to an unexpected termination of the Safari browser."
Posted by: Anonymous | June 14, 2007 5:49 PM
Posted by: John | June 14, 2007 8:27 PM
To "me":
That may be apple's usual obfuscation, but even if it is, an unexpected crash is hardly the same as remote code execution, which is what these bugs present on Windows.
Posted by: Anonymous | June 14, 2007 8:49 PM
Fastest browser? Not in my experience. It was much slower than either IE7 or Firefox2 in downloading major news sites. It imported my bookmarks fine -- although without telling me it had done so and then hid them one level down, like they're not good enough to play with Safari bookmarks -- and like I don't have enough levels to go through already. But the reason I uninstalled it was that you couldn't force the browser to use your own fonts rather than what the webmasters choose -- a feature in both IE and FF. That alone killed it for me, but it's a beta, so maybe they'll add it.
Posted by: Don Ellis | June 15, 2007 2:17 AM
GUI is the worst I have ever seen. It actually took time to bring up Google. Until now I thought Courier font was bad...I stand corrected.
Posted by: Adam | June 15, 2007 3:42 AM
I downloaded and installed Safari on Windows xp machine. The browser can not show any text including manu. I can only see the graphics. Even when I click in address window, no text shows up. Does anyone have simialr problem? Any suggestion? I restarted computer, re downloaded and reinstalled it.. same problem.
Thanks
Posted by: Shamji | June 15, 2007 7:55 PM
in your 6/15 column you mentioned soundtaxi as an unlocker of locked itunes purchases, enabling them to be used on other players. well - don't know if this is par for the course or if i happened to download a corrupt copy when i purchased the program today, but...
it would not convert my legitimately purchased itunes [claiming i had not purchased them], and it also froze my computer several times and made it maddeningly slow when it didn't freeze. uninstalling the program [which took almost a half hour because of the slowdown] corrected all that.
was this a fluke or is this a general problem with soundtaxi? i emailed a request for a refund and am keeping fingers crossed!
[love your column, by the way. as a pre technology 101 person, i am learning alot from you and your readers.]
Posted by: inge | June 17, 2007 2:59 PM
Safari beta works well on windows in my use and on the Mac OSX side too. From a Safari 2 perspective it's a more just a change or extension of features. But comparing it with Firefox 3 alphas out there in my experience mostly shows comparative evolvement - both are better. Neither is much better overall.
Posted by: me2 | June 18, 2007 9:03 AM
installed Safari to my XP but found that i cannot type anything (i.e i tried logging onto my hotmail but once i type something, the browser crashes). everytime. samething when i use wikipedia. cannot type anything using safari. anyone care to share? thanks
Posted by: thaithai | June 19, 2007 5:45 AM
The "Control-F" Find feature is really amazing. I love the fact that the screen is dimmed and the results appear animated like VH1's Popup Video (hehehe). Notice how the highlighted results look exactly like the orange iPhone's iPod icon.
http://www.apple.com/iphone/ipod/
Posted by: JR | June 21, 2007 4:00 PM
The comments to this entry are closed.










I wanted to reach you and let you know that it appears that Ipowerweb is under a huge Denial of Service attack. All of my company websites and the IPowerWeb own websites are down. I suspect this is retaliation for them going after the Malware websites referred to in your 5/24 posting.