Breaking News: Pot calls kettle black

Microsoft, creator of the very secure and robust Windows OS and the rock-solid Internet Explorer web browser, is warning Windows users not to use Apple’s browser Safari because it is unsafe and vulnerable to certain malicious sites that can take advantage of an exploit and “carpet-bomb” your Windows machine with EXE files.

According to Microsoft Security Advisory #953818 on the Microsoft website, there is a “Blended Threat from Combined Attack Using Apple’s Safari on the Windows Platform”:

Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Safari is not installed with Windows XP or Windows Vista by default; it must be installed independently or through the Apple Software Update application. Customers running Safari on Windows should review this advisory.

At the present time, Microsoft is unaware of any attacks attempting to exploit this blended threat. Upon completion of this investigation, Microsoft will take the appropriate measures to protect our customers. This may include providing a solution through a service pack, the monthly update process, or an out-of-cycle security update, depending on customers needs.”

In simple terms, Safari doesn’t seek user permission when malicious sites try to make the browser download an executable file to the desktop, even if it does this hundreds of times over and over (hence the term “carpet-bomb”). It’s a “blended threat” because this vulnerability stems from the combination of the default download location of Safari and the way Windows handles executables.

Microsoft’s Suggested Action is:

Restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.”

True, it’s a serious breach that should be fixed ay-ess-ay-pee, and we hope Apple fixes this soon. But it must be refreshing for Microsoft to be the one to call out Apple on something like this for once (I can almost here them go ‘Hah! How’d you like dem apples, Apple? Nyarharhar!’)

Researcher Nitesh Dhanjani, who first exposed this vulnerability more than a week ago, says that the flaw isn’t limited to Windows; OS X can be carpet-bombed as well, although I’m not quite sure Macs would know the first thing about running an .exe file.

Share This