Apple Safari file: // URL Remote Code Execution Vulnerability

Release date: 2011-10-17
Updated on: 2011-10-17

Affected Systems:
Apple Mac OS X 10.6.8
Apple Mac OS X Server v10.6.8
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2011-3230

Safari is the browser in Mac OS X, the latest operating system of Apple Computer. It uses KDE's KHTML as the core of browser computing.

Safari has a policy problem when processing file: // URL. malicious website browsing can cause arbitrary code execution. This vulnerability does not affect Windows.

<* Source: Aaron Sigel

Link: http://osvdb.org/show/osvdb/76388
Http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/