Apple plugged the winning vulnerability in the Pwn2own contest on Wednesday in a Safari update.
In an update for Safari (3.1.1), Apple fixed the following vulnerabilities:
CVE-2008-1026, also known as the flaw that won hacker Charlie Miller $10,000.in the Pwn2Own contest at CanSecWest. This patch covers a vulnerability that allowed a code execution attack via a maliciously crafted Web page. Here's Apple's description:
Affected OSes: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista
Among other patches:
CVE-2008-1025: Apple patched a cross-scripting vulnerability. Apple says: "An issue exists in WebKi's handling of URLs containing a colon character in the host name. Opening a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs."
Affected OSes: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2, Windows XP or Vista CVE-2008-1024: For Safari on XP and Vista only. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue exists in Safari's file downloading. CVE-2007-2398: Another one for Safari on XP and Vista. A maliciously crafted Web site can control the contents of the address bar. This issue was addressed in Safari Beta 3.0.2, but reintroduced in Safari 3.1.
- Apple bolsters QuickTime defenses… or do they?
- Apple patches 11 QuickTime flaws
- Pwn2Own: What OS really won?