Serious flaw found in Safari

By Iain Thomson on Jan 14, 2009 2:08 PM
Filed under Security

A researcher has found a flaw that would allow hackers to steal information from those using Mac OS X 10.5, aka Leopard, or Safari for the PC.

The flaw was found by open source software developer Brian Mastenbrook. It occurs when the Safari browser interacts with RSS feeds and makes the personal information of the user vulnerable.

"Safari ... is vulnerable to an attack that allows a malicious web site to read files on a user's hard drive without user intervention," Mastenbrook wrote on his blog.

"This can be used to gain access to sensitive information stored on the user's computer, such as emails, passwords, or cookies that could be used to gain access to the user's accounts on some web sites."

While he understandably does not go into detail he says that people using OS X 10.5 are vulnerable no matter what browser they are using and PC users are at risk if using the Safari browser.

He has published a suggested workaround for Apple users but advises PC users of Safari to change browser for the moment.

Mastenbrook is seen as a reliable source who has in the past found other flaws with Apple’s software.