Search the Community

Apple on Tuesday pushed out new versions of its Safari browser that address 17 security vulnerabilities in the WebKit engine. Safari 8.04, 7.14 and 6.24 patch multiple memory corruption issues in WebKit, Apple said. “These issues were addressed through improved memory handling,” Apple said in its advisory. The advisory is sparse in other details on individual CVEs; Apple said that users visiting a website hosting an exploit could put the browser at risk to remote code execution or a crash. A separate WebKit vulnerability affects the user interface and could open the door to phishing attacks. “A user interface inconsistency existed in Safari that allowed an attacker to misrepresent the URL,” Apple said. “This issue was addressed through improved user interface consistency checks.” This is the second set of Apple patches in the last 10 days. The company took care of the FREAK vulnerability in iOS along with another vulnerability that would allow a hacker to remotely restart a user’s phone via a SMS message. Apple iOS 8.2 also patched a vulnerability in the iCloud keychain function that was the result of several buffer overflows. Source

Dat fiind faptul c? Apple timp de 6 luni a ignorat eroarea raportat?, un utilizator a hot?rât s? fac? public? o secven?? de caractere arabe, care provoac? o eroare fatal? ce duce la încetarea for?at? a oric?rei aplica?ii ce folose?te WebKit. Vulnerabile fiind doar sistemele de operare: Mac OS 10.8 (Mountain Lion) ?i iOS 6. Versiunile iOS < 6 ?i 7 beta, Mac OS < 10.8 ?i 10.9 beta nu sunt afectate de aceast? problem?. Folosind acest bug, atacul DoS poate fi efectuat folosind urm?toarele metode: Trimiterea unui simplu SMS (dup? deschiderea mesajului, aceast? aplica?ie nu mai poate fi deschis?); Deschiderea unei pagini WEB (browser-ul Safari se va închide ?i o va face de fiecare dat? dac? nu este ?ters istoricul); Trimiterea unui mesaj folosind iMessage pentru iOS sau desktop Messages pentru Mac OS (aplica?ia se va închide ?i nu va mai putea fi deschis?); Crearea unui hotspot WiFi indicând „caracterele arabe” pentru numele re?elei (eroarea va ap?rea în timpul scan?rii re?elelor WiFi); Deci, exploit-ul propriu-zis: ???????????? ???? ???? ???? ??????? ????

And then Google built Chrome, and Chrome used Webkit, and it was like Safari, and wanted pages built for Safari, and so pretended to be Safari. And thus Chrome used WebKit, and pretended to be Safari, and WebKit pretended to be KHTML, and KHTML pretended to be Gecko, and all browsers pretended to be Mozilla, and Chrome called itself Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13, and the user agent string was a complete mess, and near useless, and everyone pretended to be everyone else, and confusion abounded. WebAIM: In the beginning there was NCSA Mosaic...