Secunia last week published a new vulnerability affecting Apple’s desktop Safari browser. The new exploit can be used by malicious users to execute arbitrary code on the system and is deemed to be “highly critical”.
The security research company found the exploit to grant system level access when a user "visits a specially crafted web page and closes opened pop-up windows”. Affected versions include Safari 4.0.5 for Windows, though other versions and operating systems might also be affected.
The vulnerability is caused due to an error in the handling of parent windows and can result in a function call using an invalid pointer. This can be exploited to execute arbitrary code when a user e.g. visits a specially crafted web page and closes opened pop-up windows.
Secunia credits Krystian Kloskowski with the discovery and advises users to refrain from visiting untrusted web sites or links until Apple provides an update. Apple’s Safari internet browser is available for both Mac and PC. Safari 4 added many new features including Top Sites, Cover Flow, Full History Search, a new javascript ‘Nitro’ engine, new developer tools, and a brand new interface for Windows users.