Safari 'carpet bomb' attack code released

A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers.

The source code, along with a demo of the attack, was posted Sunday on a computer security blog. It can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say.

Now that there is a public example of the attack code, Safari users running the Windows operating system should be concerned, said Eric Schultze, chief technical officer at Shavlik Technologies. "This is a bad thing. If you've got Safari, you're in trouble," he said.

[ See related stories: "Apple's Safari browser likened to malware" and "Apple dismisses Safari download issue." ]

The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a victim's desktop with executable files, an attack known as "carpet bombing."

Two weeks later, security researcher Aviv Raff said that if this flaw is exploited in combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer.

Apple has reportedly said that it has no plans to patch the Safari flaw, but Microsoft released a security advisory on the problem on May 30, a sign that it may be working on a patch.

Microsoft's advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari  as a Web browser until an appropriate update is available from Microsoft and/or Apple."

The attack affects all versions of Windows XP and Vista, Microsoft said in its advisory.

Apple could not be reached for comment on this story. Microsoft Security Response Team members were in meetings and unable to comment on this issue, a spokesman with the company's public relations agency said