Apple fixes Safari AutoFill security flaw - and more

Stephen Withers
Thursday, 29 July 2010 12:47

Business IT - Security

Apple has moved with uncharacteristic speed to patch a security flaw that exposed certain personal information to attackers. 14 other flaws have been fixed as well.

Last week, Jeremiah Grossman, chief security officer of WhiteHat Security, released a proof of concept showing how AutoFill can be misused to grab the name, work place, city, state, and email address of a visitor to a web page. No user action is required beyond navigating to the malicious page.

Grossman reported the issue to Apple a little over a month before going public, but said he could get no response from the company other than an automated reply to his original notification.

In addition to delivering extensions, Safari 5.0.1 fixes the problem by prohibiting AutoFill from using information without user action. According to Apple, the change affects both the Mac OS X and Windows versions of Safari.

Both versions also include changes to the handling of RSS feeds to block a cross-site scripting attack.

Multiple security-related changes have been made to the WebKit framework that underpins Safari. The 13 vulnerabilities are all said to potentially allow the execution of arbitrary code.

Page 2 - what's affected in WebKit, and what about those stuck on Safari 4?