Technology news and Jobs 
VIRTUALISATION Safari 3.x remains vulnerable: time to upgrade to 4.0?
VIRTUALISATION Safari 3.x remains vulnerable: time to upgrade to 4.0? | Safari 3.x remains vulnerable: time to upgrade to 4.0? |
|
| by Stephen Withers | |
| Wednesday, 10 June 2009 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
We asked Apple for clarification, and have yet to receive a reply beyond a statement that Safari 4.0 "is the full update that replaces the previous beta version of Safari 4.0 and any previous editions of Safari." But if one security researcher is correct, at least two of the addressed vulnerabilities can be found in Safari 3.x for Mac OS X and Windows. According to Google employee Chris Evans, Safari's XML processing can be fooled into delivering the contents of a local file. Not nice. "XXE [Xml eXternal Entity] attacks are most common server-side; this advisory notes a client-side attack against the Safari browser," observes Evans, who has provided a proof of concept for this vulnerability. He also notes that a second XML flaw allows cross-domain access with the potential to steal sensitive information. For this vulnerability, Evans' proof of concept shows how it can be used to steal inbox details from a logged-in Gmail session. According to Evans' descriptions of the issues, both problems were "found on Google's time" and originally reported to Apple in June 2008. Barring the prompt arrival of a Safari 3.x update from Apple, this suggests that if you can upgrade to Safari 4.0 then you probably should. |
Tags
| < Next story in category | Previous story in the category > |
|---|
