Microsoft warns of Safari for Windows hole

By

Microsoft has warned of a security hole in Safari for Windows that could allow an attacker to execute code remotely on a targeted computer..


The vulnerability could allow a hacker to "carpet bomb" files onto a user's desktop via a flaw in the Safari download system that could allow malicious code to run.

"At the present time, Microsoft is unaware of any attacks attempting to exploit this blended threat," reads the Microsoft Security Advisory.

"On completion of this investigation, Microsoft will take the appropriate measures to protect our customers.

"This may include providing a solution through a service pack, the monthly update process or an out-of-cycle security update depending on customers' needs."

Microsoft recommends that users avoid the browser or limit its ability to download directly to the desktop.

The flaw was found by vulnerability tester Nitesh Dhanjani and detailed in his blog.

"It is possible for a rogue website to litter the user's Desktop (Windows) or Downloads directory (~/Downloads/ in OSX)," he wrote.

"This can happen because the Safari browser cannot be configured to obtain the user's permission before it downloads a resource. Safari downloads the resource without the user's consent and places it in a default location (unless changed)."
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Top US diplomat impersonated with AI by unknown actor

Top US diplomat impersonated with AI by unknown actor

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

Log In

  |  Forgot your password?