Safari vulnerability worth taking note of
Yesterday, we reported on a Trojan horse for Mac OS X that is just like the entry for Earth in the Hitchhiker's Guide to the Galaxy in that it is mostly harmless. A new vulnerability targeted at Apple's home-grown web browser, Safari, is another matter entirely.
Context & Ripple Effects
On February 21, reporting identified Safari automatically executing shell scripts, establishing a browser-level route into Mac OS X distinct from the largely harmless Trojan discussed alongside it. The new issue matters because Safari, rather than a downloaded malicious program, is the affected Apple component.
Apple had also said community work on WebKit would support future Safari and WebKit releases, making browser security part of the platform's release and maintenance burden.
First-order effects
- Safari users face a more serious web-facing exposure when the browser can automatically run shell scripts, rather than relying on a separate Trojan to cause harm.
- Apple must treat Safari remediation as an immediate Mac OS X security issue, not merely a warning about unsafe downloads.
Second-order effects
- Apple's WebKit community work becomes directly relevant to fixing and validating Safari releases, increasing the importance of browser-engine maintenance.
- The contrast with the Trojan shifts attention from individual user behavior toward the security of software Apple ships and updates.
Third-order effects
- If browser flaws recur, Safari's attack surface will become a central measure of Mac OS X security rather than a secondary concern beside standalone malware.
- Apple's ability to combine WebKit development with prompt Safari fixes will increasingly shape confidence in its platform security.
The trend: Mac OS X security is moving from a focus on isolated malware toward scrutiny of vulnerabilities in Apple-controlled browser software.