Code-execution bug found in Apple Safari
Beware of pop-up Windows
The latest version of Apple's Safari browser contains a critical bug that allows attackers to install malware on end user machines, security researchers have warned.
The flaw in the way Safari handles parent windows can be exploited "to execute arbitrary code when a user visits a specially-crafted webpage and closes opened pop-up windows," vulnerability tracking service Secunia warned here.
The vulnerability could also be exploited using booby-trapped email that's read using Safari, the US Computer Emergency Readiness Team said on Monday. It has been confirmed in version 4.0.5 for Windows, and the latest Mac version may also be affected.
The vulnerability was discovered by Polish researcher Krystian Koskowski, who shared this proof-of-concept. Secunia rated the vulnerability "highly critical," the second-highest rating on its five-tier severity scale. US CERT's advisory said researchers there were able to confirm the vulnerability.
*kssh*Good kill, Good kill, over*kshht*
@Tom Chiverton 1
A lot more smoothly and safely than the Wintards.
You may have noticed that this defect affects the Windows version of Safari...
Noun: Holiday. Specifically one where you go somewhere exciting, see lots of interesting things and also quite probably catch something nasty. You may also get badly burned and regret it.
See also: Sun lotion, Montezuma's revenge.