US in danger of losing green-tech competition, experts say

TECHNOLOGY
- Infrastructure
  - Network
  - Security
    - Virus
    - Intruder
    - Spyware
    - Spam
    - Theft
    - Disaster Recovery
    - Privacy
    - Regulatory Compliance
  - Client
    - Desktop
    - Laptop
    - Laptop - Macbook
    - PDA
  - Server
    - Load Balancing
  - Mobile
  - Operating Systems
    - Windows
    - Windows - Vista
    - Linux
    - Mac
    - Mac - Leopard
    - Unix
    - Other
  - Data Center
  - Virtualization
- Applications
  - SaaS
  - Cloud Computing
  - ERP
  - CRM
  - BI
  - BPM
  - KM
  - SCM
  - RFID
  - Middleware/EAI
  - Portals
    - B-to-B
    - Consumer
  - Inventory Management
  - Databases
  - Document Management
  - E-Business
  - Data Warehouse
- Development
  - Open Source
  - Eclipse
  - Java
  - .NET
  - Agile
  - Web Services
- Architecture
  - SOA
  - Enterprise Architecture
LEADERSHIP

IT DRILLDOWN

NEWSLETTERS

CIO.com updates, insights and advice on technology, management and your career.

RSS Feeds »

LEADERSHIP

CIO Executive Programs

The Leader in Face-to-Face Education for Senior Executives

Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »

CIO Executive Council

A Peer-Advisory Service and Professional Association for CIOs

Social Responsibility's Strategic Benefits

December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)

Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.

Working With and Communicating to Your Board of Directors

January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)

CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.

IT's Role in Growing Mid-Market Companies

January 14, 4:00 PM - 5:00 PM ET (GMT-5)

Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.

More / Register »

Learn more about the CIO Executive Council »

RESOURCE CENTER

buy a link »

SUBSCRIBE TO CIO

Are you involved in setting the direction for your company's IT budget or strategy?

Apply today for a FREE subscription to CIO Magazine!

Subscription Services »

Reprints »

News

Apple Fixes Safari 'carpet Bomb' Bug

Apple has reversed course and patched a bug in its Safari browser after security researchers showed how it could be used to run unauthorized software on a Windows machine.

Leave a comment

By Robert McMillan

June 19, 2008 — IDG News Service —

Apple has reversed course and patched a bug in its Safari browser after security researchers showed how it could be used to run unauthorized software on a Windows machine.

The "carpet bomb" bug, which was originally discovered by security researcher Nitesh Dhanjani, was initially thought to be less serious than it turned out to be.

Dhanjani showed how Safari could be misused to litter a victim's desktop with downloaded programs, but two weeks after he disclosed his research, another hacker, named Aviv Raff, showed that this flaw could be exploited in tandem with other problems in Windows and Internet Explorer to run unauthorized software on a victim's PC.

That prompted Microsoft to issue its own warning about the issue. It also caused some security experts to caution Web surfers about using Safari on the Windows platform.

According to Dhanjani, Apple initially told him that it did not intend to fix the issue, but apparently the company has now changed its mind.

Apple fixed the issue in the 3.1.2 version of its Safari browser for Windows, which was released Thursday afternoon. This update addresses a total of four security issues in Safari, including bugs in the way Safari renders JavaScript arrays and handles the downloading of executable files.

It also fixes a less-critical issue in the way Safari renders Bitmap and Gif images, which could give attackers a peek at the memory of a victim's computer, Apple said.

Thursday's update was for Windows computers only, and Apple has not yet released a 3.1.2 Safari update for the Mac.

The Mac version of Safari is also subject to the carpet bombing attack. But unlike Windows, the Mac does not suffer from the second flaw, which allows a carpet bomb attack to be used to take control of a victim's machine. Also, Mac OS X squirrels downloaded files into a special folder, rather than depositing them on the desktop, making things a little safer on the Mac, Dhanjani said in an interview late Thursday.

He said it makes sense for Apple to fix the issue on Windows first because of the severity of this tandem attack. But he expects a Mac patch as well. "It's still a security issue," he said. "I would be very surprised if they don’t update it."

Dhanjani said that he hasn't heard from Apple since its initial response to his bug report.