Apple Releases Safari 3.1.1, Addresses PWN2OWN Vulnerability

bcomer · Apr 16, 2008, 04:32 PM

Apple has released Safari 3.1.1 for download.

Sky Blue · Apr 16, 2008, 04:34 PM

Nice. Safari 3.1 was a bit weird for me.

Tallest Skil · 04:41 PM

Ooh! Let me guess what it fixes! Um... "general compatibility and security issues"

Edit: Well, actually, I forgot stability!

BoyBach · Apr 16, 2008, 04:41 PM

According to Software Update:

Quote:

This update is recommended for all Safari users and includes improvements to stability, compatibility and security.

For detailed information on the security content of this update, please visit this site: http://support.apple.com/kb/HT1222

EDIT: p.s. It also requires a restart.

MacMan33 · Apr 16, 2008, 04:42 PM

hope this makes a difference, it has been crazing on me for awhile now...

hodgjy · Apr 16, 2008, 04:56 PM

Does anyone know if this is based on a newer version of Webkit?

sblasl · 05:17 PM

CVE-ID: CVE-2008-1024
Available for: Windows XP or Vista
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in Safari's file downloading. By enticing a user to download a file with a maliciously crafted name, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of file downloads. This issue does not affect Mac OS X systems.

WebKit
CVE-ID: CVE-2008-1025
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista
Impact: Visiting a malicious website may result in cross-site scripting
Description: An issue exists in WebKi's handling of URLs containing a colon character in the host name. Opening a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs. Credit to Robert Swiecki of Google Information Security Team and David Bloom for reporting this issue.

WebKit
CVE-ID: CVE-2008-1026
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista
Impact: Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution
Description: A heap buffer overflow exists in WebKit's handling of JavaScript regular expressions. The issue may be triggered via JavaScript when processing regular expressions with large, nested repetition counts. This may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller for reporting these issues.

Important: Information about products not manufactured by Apple is provided for information purposes only and does not constitute Apple's recommendation or endorsement. Please contact the vendor for additional information."

-Alan- · Apr 16, 2008, 05:04 PM

I was hoping Safari's Reset would be fixed. The reset doesn't work reliably. You have to change an option each time for it to work.

jas8522 · Apr 16, 2008, 05:04 PM

Notice the last one there - a bug in WebKit that could allow arbitrary code execution (reported by Charlie Miller)? Arbitrary code execution... sounds like what happened recently when a MacBook Air was hacked at a security conference by ... oh wait, it was Charlie Miller!

http://venturebeat.com/2008/03/28/ch...n-mac-hacking/

Seems like the WebKit team has patched the vulnerability.

Morod · Apr 16, 2008, 05:06 PM

Did someone say "snappier"?

I downloaded it, not sure that I see a difference yet.
Morod

dejo · Apr 16, 2008, 05:09 PM

I wonder how Gmail and MacRumors handle 3.1.1 now that's it's officially released. I had it as part of the last 10.5.3 seed and both sites considered it an unsupported browser.

MacRumors · 07:35 PM

Apple has released Safari 3.1.1 for Mac and Windows, now available via its website and Software Update.

Quote:

This update is recommended for all Safari users and includes improvements to stability, compatibility and security.

Most significantly, Apple notes that 4 security issues have been patched in the release, one of which was recently used to successfully attack a MacBook Air in the CanSecWest PWN2OWN contest.

Article Link

-Alan- · Apr 16, 2008, 05:13 PM

I was hoping Safari's Reset would be fixed. The reset doesn't work reliably. You have to change an option each time for it to work.

(I made this same post to the other thread)

aliquis- · Apr 16, 2008, 05:14 PM

So when will they fix the memory leaks and the occasional bla bla do you really want to close x number of tabs when it for whatever reason belive I want to close a window and not a tab with command-w?

Safari use like 1GB ram within a day and I hate when I just press enter and boom, gone.

A good undo such as the one in Opera would be nice to.

Or one can just use Opera ...

Would be sweet if they could make it so plugins work with different versions aswell, I can't run pithelmet with 3.1.

Would be nice if one could always quit it without using force quit every now and then aswell.

Safari is a piece of junk.

Toe · Apr 16, 2008, 05:15 PM

This update seems to be nothing but security (i.e., no feature changes). The detail page does not say anything at all, besides linking to the security page, which then links to the security detail.

ShiggyMiyamoto · Apr 16, 2008, 05:15 PM

Haha.. pwn2own... Wow. My MacBook is in the shop right now, but once I get it back I'll do this update...

Kiddo86 · Apr 16, 2008, 05:17 PM

Use WebKit too!

http://nightly.webkit.org/start/trunk/31916

hodgjy · Apr 16, 2008, 05:18 PM

This, to me, means that the final version of 10.5.3 is not due out for a while--otherwise Apple wouldn't have released Safari 3.1.1 as a separate, high priority update.

Quote:

Originally Posted by dejo

I wonder how Gmail and MacRumors handle 3.1.1 now that's it's officially released. I had it as part of the last 10.5.3 seed and both sites considered it an unsupported browser.

firstapple · Apr 16, 2008, 05:19 PM

Quote:

Originally Posted by Toe

This update seems to be nothing but security (i.e., no feature changes). The detail page does not say anything at all, besides linking to the security page, which then links to the security detail.

I wouldn't expect any features in a 3.1.x update. Simply security fixes. Can't complain too much about that right?

An added note though... 39 MB's??? Geez, must be quite the security fixes

BlakTornado · 07:33 PM

But the real question is: Are large RSS feeds going to keep making it hang?

Oh and does it still leak memory?

Clive At Five · Apr 16, 2008, 05:20 PM

Great, now I have to uncheck the intrusive Safari "INSTALL ME" box for the next three weeks before I decide, "screw it" and install the new version, even though I don't want it, but I'll do it so it will stop hassling me.

BRLawyer · Apr 16, 2008, 05:32 PM

Quote:

Originally Posted by jas8522

Notice the last one there - a bug in WebKit that could allow arbitrary code execution (reported by Charlie Miller)? Arbitrary code execution... sounds like what happened recently when a MacBook Air was hacked at a security conference by ... oh wait, it was Charlie Miller!

http://venturebeat.com/2008/03/28/ch...n-mac-hacking/

Seems like the WebKit team has patched the vulnerability.

I wonder if the habitual whiners in this forum are still gonna complain about Apple's "tardy reaction" to security issues...Apple not only promptly listens to its customers when it comes to OS criticism (such as Stacks), but also addresses in due course the relevant issues that are identified...

GO APPLE!

bob-innox · Apr 16, 2008, 05:34 PM

What's with all the "Requires a restart" nonsense?

Is this to make it compatible with Windows?

Pippen Man · Apr 16, 2008, 05:37 PM

I've downloaded it, but the only problem I've ever had with Safari (on on a Vista computer) is that I couldn't download anything from websites. The download window would never work, and the files would never open.

Any suggestions?

P.S. No Windows Vista bashing, or I'll have your heads.

TheSpecialist · Apr 16, 2008, 05:39 PM

Apple Software Update is now version 2.1 for Windows

!

Apr 16, 2008, 04:32 PM	#1
bcomer macrumors newbie Join Date: Jan 2008 Location: Ottawa	Safari 3.1.1 released Apple has released Safari 3.1.1 for download.

Apr 16, 2008, 04:34 PM	#3
Tallest Skil Banned Join Date: Aug 2006 Location: 1 Geostationary Tower Plaza	Ooh! Let me guess what it fixes! Um... "general compatibility and security issues" Edit: Well, actually, I forgot stability! Last edited by Tallest Skil : Apr 16, 2008 at 04:41 PM.

Apr 16, 2008, 04:42 PM	#5
MacMan33 macrumors regular Join Date: Jun 2007 Location: Chicago	hope this makes a difference, it has been crazing on me for awhile now... __________________ Macbook 1.83 Dual Core 120gig hd Ibook G4 800 120gig HD powerbook G3 500 40gig IPhone V1 16 Gig IPhone V2 16 Gig Black

Apr 16, 2008, 04:56 PM	#7
sblasl macrumors 6502a Join Date: Apr 2004 Location: Heber Springs, AR	CVE-ID: CVE-2008-1024 Available for: Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in Safari's file downloading. By enticing a user to download a file with a maliciously crafted name, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of file downloads. This issue does not affect Mac OS X systems. WebKit CVE-ID: CVE-2008-1025 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista Impact: Visiting a malicious website may result in cross-site scripting Description: An issue exists in WebKi's handling of URLs containing a colon character in the host name. Opening a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs. Credit to Robert Swiecki of Google Information Security Team and David Bloom for reporting this issue. WebKit CVE-ID: CVE-2008-1026 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista Impact: Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in WebKit's handling of JavaScript regular expressions. The issue may be triggered via JavaScript when processing regular expressions with large, nested repetition counts. This may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller for reporting these issues. Important: Information about products not manufactured by Apple is provided for information purposes only and does not constitute Apple's recommendation or endorsement. Please contact the vendor for additional information." __________________ Pardon Multimedia - please give MM another chance! Last edited by longofest : Apr 16, 2008 at 05:17 PM. Reason: don't quote if you're not going to be addressing the quoted material

Apr 16, 2008, 05:04 PM	#8
-Alan- macrumors member Join Date: Mar 2007	Safari Reset I was hoping Safari's Reset would be fixed. The reset doesn't work reliably. You have to change an option each time for it to work. __________________ Convert

Apr 16, 2008, 04:34 PM	#2
Sky Blue macrumors 68040 Join Date: Jan 2005	Nice. Safari 3.1 was a bit weird for me.

Apr 16, 2008, 04:56 PM	#6
hodgjy macrumors 6502 Join Date: Apr 2005	Does anyone know if this is based on a newer version of Webkit?

Apr 16, 2008, 05:04 PM	#9
jas8522 macrumors newbie Join Date: Dec 2007	Charlie Miller Notice the last one there - a bug in WebKit that could allow arbitrary code execution (reported by Charlie Miller)? Arbitrary code execution... sounds like what happened recently when a MacBook Air was hacked at a security conference by ... oh wait, it was Charlie Miller! http://venturebeat.com/2008/03/28/ch...n-mac-hacking/ Seems like the WebKit team has patched the vulnerability.

Apr 16, 2008, 05:06 PM	#10
Morod macrumors 6502a Join Date: Jan 2008 Location: On The Nickel, over there....	Did someone say "snappier"? I downloaded it, not sure that I see a difference yet. Morod __________________ Everything should be made as simple as possible, but not simpler. Albert Einstein

Apr 16, 2008, 05:09 PM	#11
dejo macrumors Demi-God Join Date: Sep 2004 Location: On the roadside	I wonder how Gmail and MacRumors handle 3.1.1 now that's it's officially released. I had it as part of the last 10.5.3 seed and both sites considered it an unsupported browser.

Apr 16, 2008, 05:13 PM	#13
-Alan- macrumors member Join Date: Mar 2007	Safari Reset I was hoping Safari's Reset would be fixed. The reset doesn't work reliably. You have to change an option each time for it to work. (I made this same post to the other thread) __________________ Convert

Apr 16, 2008, 05:14 PM	#14
aliquis- macrumors 6502a Join Date: May 2007	So when will they fix the memory leaks and the occasional bla bla do you really want to close x number of tabs when it for whatever reason belive I want to close a window and not a tab with command-w? Safari use like 1GB ram within a day and I hate when I just press enter and boom, gone. A good undo such as the one in Opera would be nice to. Or one can just use Opera ... Would be sweet if they could make it so plugins work with different versions aswell, I can't run pithelmet with 3.1. Would be nice if one could always quit it without using force quit every now and then aswell. Safari is a piece of junk. __________________ Apple makes an half decent OS, unbalanced low-end expensive computers but with well designed cases and user interfaces.

Apr 16, 2008, 05:15 PM	#15
Toe macrumors 65816 Join Date: Mar 2002	This update seems to be nothing but security (i.e., no feature changes). The detail page does not say anything at all, besides linking to the security page, which then links to the security detail. __________________ Have BlackBook and iPhone. Have operated almost every Mac model. Avoid fake Cuban cigars. — Get real cigar artwork.

Apr 16, 2008, 05:15 PM	#16
ShiggyMiyamoto macrumors 6502 Join Date: Mar 2004 Location: Just outside Boston, MA.	Haha.. pwn2own... Wow. My MacBook is in the shop right now, but once I get it back I'll do this update... __________________ MacBook "Santa Rosa" 2.2 GHz Intel Core 2 Duo 4 GB RAM \| 500 GB HDD \| Intel GMA X3100 Mac OS X 10.6.2 \| No Secondary OS Installed ATM...

Apr 16, 2008, 05:17 PM	#17
Kiddo86 macrumors newbie Join Date: Apr 2008	Use WebKit too! http://nightly.webkit.org/start/trunk/31916

Apr 16, 2008, 05:20 PM	#20
BlakTornado macrumors 6502a Join Date: Apr 2007 Location: England	But the real question is: Are large RSS feeds going to keep making it hang? Oh and does it still leak memory? __________________ 20" 2.4GHz iMac Website Album Podcast Last edited by WildCowboy : Apr 16, 2008 at 07:33 PM. Reason: removed reference to deleted post

Apr 16, 2008, 05:20 PM	#21
Clive At Five macrumors 65816 Join Date: May 2004 Location: St. Paul, MN	Great, now I have to uncheck the intrusive Safari "INSTALL ME" box for the next three weeks before I decide, "screw it" and install the new version, even though I don't want it, but I'll do it so it will stop hassling me. __________________ My Mod: G4 Cube + Atom 330 CPU + Wiimote = Ultimate HTPC!

Apr 16, 2008, 05:34 PM	#23
bob-innox macrumors newbie Join Date: Apr 2008	What's with all the "Requires a restart" nonsense? Is this to make it compatible with Windows?

Apr 16, 2008, 05:37 PM	#24
Pippen Man macrumors regular Join Date: Jan 2008	I've downloaded it, but the only problem I've ever had with Safari (on on a Vista computer) is that I couldn't download anything from websites. The download window would never work, and the files would never open. Any suggestions? P.S. No Windows Vista bashing, or I'll have your heads. __________________ Windows Vista... or Windows Mojave? iPod touch 16GB 2.0 iPod shuffle, 1GB

Apr 16, 2008, 05:39 PM	#25
TheSpecialist macrumors 6502 Join Date: Jun 2007 Location: The Netherlands, Europe	Apple Software Update is now version 2.1 for Windows!

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode