Apple Mac OS X Safari Command Execution Vulnerability
Apple Safari running on Mac OS X
A file type determination vulnerability in Apple Safari could allow a remote attacker to execute arbitrary commands on a vulnerable system.
Apple Safari is a web browser that comes with Apple Mac OS X. The default configuration of Safari allows it to automatically "Open 'safe' files after downloading." Due to this default configuration and inconsistencies in how Safari and OS X determine which files are "safe," Safari may execute arbitrary shell commands as the result of viewing a specially crafted web page.
Information about VU#999708 is also available in US-CERT Technical Alert TA06-062A.
A remote, unauthenticated attacker could execute arbitrary commands with the privileges of the user running Safari. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system.
Install an update
Disable "Open 'safe' files after downloading"
With the update installed, Safari will no longer automatically execute certain types of downloaded files and may also display a warning dialog. For additional protection, disable the option to "Open 'safe' files after downloading," as specified in "Securing Your Web Browser."
Appendix A. References
- US-CERT Vulnerability Note VU#999708 - http://www.kb.cert.org/vuls/id/999708
- US-CERT Technical Cyber Security Alert TA06-062A - http://www.us-cert.gov/cas/techalerts/TA06-062A.html
- Securing Your Web Browser - http://www.us-cert.gov/reading_room/securing_browser/#sgeneral
- CVE-2006-0848 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0848
- Apple - Mac OS X - Safari RSS - http://www.apple.com/macosx/features/safari/
Feedback can be directed to the US-CERT Technical Staff
February 22, 2006: Initial release
February 23, 2006: Added CVE reference
March 3, 2006: Updated solution and added reference to TA06-062A