Latest in Carpetbomb

Image credit:

Safari 'carpet bombing' attack code in the wild

Robert Palmer
June 11, 2008
Share
Tweet
Share

Sponsored Links

The Safari "carpet bombing" blended-threat vulnerability discovered in May could be more dangerous for Windows users with exploit code available online.

Mac users are not affected by the threat.

The exploit takes advantage of the fact that the Desktop is Safari's default download location. Pair that with a flaw in Internet Explorer that allows files of a particular name to be automatically run, and you have a situation where Safari downloads a file and IE runs it.

InfoWorld notes that the source code and demo were posted on Sunday. Apple, so far, has not commented on the InfoWorld story, and has no plans to alter Safari. Since downloading to the Desktop is Safari's only involvement in the threat, there doesn't appear to be any problem to correct.

Microsoft's problem, on the other hand, has to do with automatically running files that just happened to be named something IE cares about, which Microsoft has known about since 2006. Microsoft has not commented on the story either, but their suggestion is still to avoid using Safari for Windows.

In this article: carpetbomb, ie7, safari
All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Share
Tweet
Share

Popular on Engadget

Presenting the Best of CES 2021 winners!

Presenting the Best of CES 2021 winners!

View
Smartwatches may detect the signs of COVID-19 before you know you're sick

Smartwatches may detect the signs of COVID-19 before you know you're sick

View
Scientists may have found the background ripples of the universe

Scientists may have found the background ripples of the universe

View
Parler's website is back up, but the service is still unavailable

Parler's website is back up, but the service is still unavailable

View
'Apex Legends' season 8 adds a new demolitionist character

'Apex Legends' season 8 adds a new demolitionist character

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr