Note: This page is part of the archive.

This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact if you have any questions about the US-CERT website archive.

Alert (TA06-053A)

Apple Mac OS X Safari Command Execution Vulnerability

Systems Affected

Apple Safari running on Mac OS X


A file type determination vulnerability in Apple Safari could allow a remote attacker to execute arbitrary commands on a vulnerable system.


Apple Safari is a web browser that comes with Apple Mac OS X. The default configuration of Safari allows it to automatically "Open 'safe' files after downloading." Due to this default configuration and inconsistencies in how Safari and OS X determine which files are "safe," Safari may execute arbitrary shell commands as the result of viewing a specially crafted web page.

Details are available in the following Vulnerability Note:

VU#999708 - Apple Safari may automatically execute arbitrary shell commands

Information about VU#999708 is also available in US-CERT Technical Alert TA06-062A.


A remote, unauthenticated attacker could execute arbitrary commands with the privileges of the user running Safari. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system.


Install an update

Install Apple Security Update 2006-001. This and other updates are available via Apple Update.

Disable "Open 'safe' files after downloading"

With the update installed, Safari will no longer automatically execute certain types of downloaded files and may also display a warning dialog. For additional protection, disable the option to "Open 'safe' files after downloading," as specified in "Securing Your Web Browser."

Appendix A. References

Feedback can be directed to the US-CERT Technical Staff

Produced by US-CERT, a government organization. Terms of use

Revision History

  • February 22, 2006: Initial release
    February 23, 2006: Added CVE reference
    March 3, 2006: Updated solution and added reference to TA06-062A

    Last updated

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No