Apple has released Safari 3.0.1 Public Beta for Windows XP and Vista which includes numerous security improvements which Apple notes do not affect Safari 3 Public Beta for Mac OS X.
Safari 3.0.1 Public Beta for Windows addresses the following issues in Safari 3 Public Beta for Windows:
CVE-ID: CVE-2007-3186
Impact: Visiting a malicious website may lead to arbitrary code execution.
Description: A command injection vulnerability exists in the Windows version of Safari 3 Public Beta. By enticing a user to visit a maliciously crafted web page, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional processing and validation of URLs. This does not pose a security issue on Mac OS X systems, but could lead to an unexpected termination of the Safari browser.
CVE-ID: CVE-2007-3185
Impact: Visiting a malicious website may lead to an unexpected application termination or arbitrary code execution.
Description: An out-of-bounds memory read issue in Safari 3 Public Beta for Windows may lead to an unexpected application termination or arbitrary code execution when visiting a malicious website. This issue does not affect Mac OS X systems.
CVE-ID: CVE-2007-2391
Impact: Visiting a malicious website may allow cross-site scripting.
Description: A race condition in Safari 3 Public Beta for Windows may allow cross site scripting. Visiting a maliciously crafted web page may allow access to JavaScript objects or the execution of arbitrary JavaScript in the context of another web page. This issue does not affect Mac OS X systems.
The update is available via the “Apple Software Update” application, which is installed with the most recent version of QuickTime or iTunes on Windows.
MacDailyNews Take: That was about as fast as, oh, say, putting a cigarette out in someone’s eye and certainly more productive.
Wow, that was quick.
Hey, hey, now the silly un-informed conspiracy folks can come out and say that Apple release Safari 3 on purpose to show that the Mac OS is more secure than Windows.
” width=”19″ height=”19″ alt=”smile” style=”border:0;” />
Stupid move. Apple should have done more testing. Now thousands of Windows users are pissing and moaning about how lousy Safari is, after using it before this release. I know, I know, it’s a beta release. Tell that to the media.
see! it’s what beta is all about
and perhaps a sneaky ploy to gain more publicity
so, the media says… “Safari Beta is buggy!” to which most people reply “yeah, it’s a beta”.
i think stupidity is overblown.
Ok, to ANYONE who is bashing Apple for releasing an application with “bugs” or “security issues”, etc. – SHUT THE PIE HOLE! Do you know the meaning of the word BETA???? One of the purposes of releasing a program in beta to the public is TO FIND ADDITIONAL PROBLEMS – IE BUGS AND SECURITY PROBLEMS, only then can the company (Apple) make the necessary changes! Apple does not have the experience in releasing Windows apps like many other companies, and therefore, this is probably the best way for their staff to find the remaining problems and get them corrected before releasing a GM of the app. Good God people, you think a beta application shouldn’t have any problems to it!
But in tests by Wired News Safari was slower than both Internet Explorer 7 and Firefox 2
Check out the story & the test results at
http://iprodreviews.blogspot.com/2007/06/safari-3-is-slower-than-ie-7-firefox.html
“Mac OS X is unaffected.”
As usual. Nothing to see here.
Can I say Safari 3 works perfectly on my system, but then I was smart enough to buy a Macintosh.
And – to those Windows users who are whinging – a) remember what the Vista beta was like and b) it’s a fscking beta. Microsoft were responsible for the rise in popularity of public beta programmes back when they pre-launched Win95 (a whole operating system – although that’s using the term loosely) and got a couple of million people to help them debug it – don’t whine if Apple now uses the same approach for a browser.
@iprodreviews
In response to this, Apple tested the speed of Safari independent of the internet, in otherwords raw compiling and load speeds. You can’t perform a speed test using live data from the internet because there are too many variables. You are relying on the speed of the servers from the hosted site, you are relying on the packet data delivery, and you are relying on your connection as well.
Speed has to be determined with all of those variables removed, otherwise the test is useless. Apple understood this and that is how they tested Safari’s speed.
Let’s see M$ or even Firefox fix vulnerabilities in less than 3 days! They never get security updates out even close to this fast. Anyone that is bitching about this Safari beta for Windows is nothing more than a M$ fanboi anyway…
@ iprodreviews.blogspot.com:
The tester used a website that Safari is known to have issues with. Even if that wasn’t the case, they only used one website to test, which is statistically worthless, unless you only use one website. The tester really should test it on several websites using different technologies (such as JavaScript, CSS, AJAX, larged nested tables, etc.) and see who comes out ahead on all of them.
The turnaround speed was interesting. What this means is a TON of advertizing for Apple. Even if bad, everyone was hearing about Safari for Windows. Apple shows that it is lightening quick to fix wrongs showing just how responsive it is to its customers.
All good…….brilliant!
Funny how Windows folks of all people could scream about a couple of security holes right after a beta was released. I suspect that if this was from Redmond, they’d be lined up to sing Steve Ballmer’s praises, and encouraging people to have patience and give this a chance. They’re the same people who are willing to wait until MS posts its SP1 patch to Vista before they make a final judgment.
Apple could, and should, have done better in releasing this, though. Apple is the Avis of the pc world, it has to work harder and be better than the market leader. Hopefully this will patch the holes and encourage people to try the browser.
“Now thousands of Windows users are pissing and moaning about how lousy Safari is, after using it before this release. “
aside from ‘Mac at home windows at work’ and a few really diehard nerds, how many windows users do you really think have even HEARD about it yet? 12? 15?
this won’t be anything important to the windows world until it starts getting downloaded by millions of iPhone users in a few weeks. as long as it is ready by then…….
Same application, different platforms. I can’t imagine a better comparison of the inherent security of both platforms. Probably a better test than iTunes because the internet is the security metric these days. The development fork didn’t hurt iTunes, let’s hope it’s the same for Safari.
Long live Unix and Apple’s ability to let most users not care what it is.
Anyone notice that Safari for Windows does not follow the Windows OS look and feel and guidelines at all? Look at the way notification boxes slide out of the menu bar, the way fonts are rendered, clicking and dragging images from a web page to a desktop, preference panes, etc…. Compare this with iTunes for Windows which does follow the Windows UI more closely, where for example the preferences are divided into tabs (typical Windows style). It’s like instead of just porting Safari to Windows, they have created a Mac “layer” on top of Windows. It’s weird.
While I see both sides of this argument, Apple almost always has the high ground on quality and stability of its software, particularly compared to M$. Most of the time, if not always, an Apple “beta” exceeds M$’s released software in quality
Apple released a bad, bad first beta, there’s no getting around it here. In this one instance, Apple blew it.
iTunes keeps crashing since I installed Safari on my Mac.
You have to wonder if this was intentional… I mean, an update fixing vulnerabilites just 2 days after a software release makes Apple “look good” for being responsive while at the same time it really points out the flaws of the Windows platform… Hmm.
Considering that this safari product is actually the latest product to be ported from OSX. Chances are, it is using the same framework that Itunes is using, but it is a much more feature filled framework.
I don’t know if it’s my imagination but Safari3 is pretty snappy on my G4 powerbook.
This is another ice cube for the water glass (in hell)
I’ve been looking for 15 minutes trying to figure out how to do the update. Anyone here know how to do it? Thanks.
I would be more shocked if the beta was perfect in every way.
It’s ironic that the people that Microsoft piad to spread FUD about the Safari for Windows beta, caused Apple to respond so fast to improve their product. Maybe Ballmer will be throwing more chairs today than he did on Monday?
My Apple Software Update says my software is up to date even though I have Safari 3.0 installed. How do I get it to see that I need the 3.0.1 update?
I just found it. Go to Start > Programs > Apple Software Update.
That will update all the Apple software on your machine. Geesh! Windows is so lame.
to Diz
…try “about Safari”
I would prefer for Apple to set a higher standard when delivering software to the Windows world.
But the windoze users are used to Buggy Software….why should they be so upset. The majority of windoze users use IE, which is not even beta software and still is buggy as hell!
I think Apple is learning from this experience and will get better in future releases. I think they are really learning how easy it is for software to be exploited on a windows operating system.
Notice how these vulnerabilities do not affect safari on a Mac!
@ adman
“…..I’ve been looking for 15 minutes trying to figure out how to do the update. Anyone here know how to do it? Thanks….”
Click Here
Winbloze doesn’t see that I need the new Safari update, either. Anyway to force it to update? My “About Safari” shows version 3.0 and I ran the stupid Start>Programs thing.
Ain’t so easy to make secure software for Windoze, huh….
Just my $0.02
Too bad they didn’t update any bugs yet. I know it’s BETA, but it crashes every time I try to login to the Windows server proxy at work, Safari crashes instantly. I’d like to be able to use this software!
caddisfly:
I didn’t clarify. I’m at work and running Safari Version 3.0 (522.11.3) on my Windows XP machine. The “About Safari” box doesn’t have an update software selection, nor does that option reside anywhere else in Safari 3.0 Beta for Windows. I’m stuck running Apple Software Update (for Windows) and it’s not seeing Safari 3.0.1.
🙁
I just used Apple Software Update here at work (Windows XP PC) – found the update no problem. I am now running 3.0.1.
Expect Safari 3.0 to be at 3.0.239 in no time, and remain at 3.0.0 on the Mac.
The whole Windows world does in fact suck.
Rock on Steve!
” width=”19″ height=”19″ alt=”raspberry” style=”border:0;” />
Most of the blogs on ZDNet since the keynote are about Apple. And they hate us. Getting involved with any of the discussions there is totally frustrating and it’s best just to stay away from all that fear and loathing. Especially that “NonZealot” poster. He’s totally batshit!
Actually, installing Safari 3 on my Mac screwed up my iChat. I’m not the only one, either, as it seems that lots of people are having the same problem:
http://forums.macrumors.com/showthread.php?t=313002
Since installing Safari 3.0 on my Intel iMac, I can no longer view PDF files in the Safari window.
I have Acrobat Pro 8 and have used the “Repair Acrobat Installation” to reinstall the PDF Viewer for Safari but that doesn’t help.
Anybody have any ideas?
Seems pretty dumb but I just went ahead and downloaded the whole thing from Apple again. Now my Winbloze machine shows 3.01.
Hey, hey, now the silly un-informed conspiracy folks can come out and say that Apple release Safari 3 on purpose to show that the Mac OS is more secure than Windows
—
Hmm, the thing is, I’ve heard Win ppl say “Wow, Apple has viruses now that it’s marketshare is more than the margin of error”
I mean.. they try to conflate the Stability of OS X and the Stability of a piece of software written for Windows. Idiotic. The funny thing is, in OS X, you can have beta software, and it doesn’t matter, because when it crashes it doesn’t take your whole system down.
In Windows… er. LOL
So to Windows users, enjoy Safari… it will get much better, very quickly, I assure you the Mac experience of Safari is pretty damn sweet.. .like.. iTunes on a Mac.. and.. say.. MSN Messenger on Windows
The REAL results are coming in now – people LOVE Safari on Windows.
It will make great headway. AND this was great advert to show why Apple is more security conscious than Microsoft.
You almost wonder if Apple deliberately put that version out to be able to demonstrate how fast they fix things. MS would have stayed silent for a year or more…
Speaking of MS, where the FSCK is Office 2008
i did and have only had 1 crash, checking email on gmail. removed the plist, reboot, no probs.
always repair permission when installing new apps, or updates.
this is in mac os x of course, can’t comment on xp or vista.
ok i will, friends don’t let friends use windows.
eWorldian, I’m having the same problems and I don’t know what’s causing it. I’m wondering if it’s a conflicting plug-in. Here’s my list, from Library / Internet Plug-Ins /. Any overlaps with yours besides the obvious ones?
AdobePDFViewer.plugin
DRM Plugin.bundle
Flash Player.plugin
flashplayer.xpt
Flip4Mac WMV Plugin.plugin
Flip4Mac WMV Plugin.webplugin
ipxBrowserPlugin
Java Applet Plugin Enabler
Java Applet.plugin
JavaPluginCocoa.bundle
NP-PPC-Dir-Shockwave
NPSVG3Carbon
nsIQTScriptablePlugin.xpt
Quartz Composer.webplugin
QuickTime Plugin.plugin
QuickTime Plugin.webplugin
RealPlayer Plugin.plugin
VerifiedDownloadPlugin.plugin
Word Browser Plugin.plugin
That’s pretty much Apple’s MO. Release and quickly fine tune.
And I don’t get why browser crashes are Apple’s fault? I’ve sent 5 crash reports last week alone.
Ummm, that was before Safari was released. That was ALL Firefox. That’s why Firefox has that (Return to Old Session, Start New Session), buttons when it crashes.
You know, it doesn’t take much to become the best browser on PC…not much at all.
Safari 3.0 also blocks pop-under ads from MDN
Re: EvangelizeWithRespect
I don’t think (at this point) that it’s a conflicting Plug-In.
I’m thinking more that the Acrobat PDFViewer plug-in for Safari is simply not compatible with Safari 3.0.
I’ve sent an email to Adobe, but have yet to hear back.
Can some of you guys give my comment defending Safari for windows the thumbs up (positive rating) please?
” width=”19″ height=”19″ alt=”grin” style=”border:0;” />
http://www.computerworld.com/comments/node/9024488
Cheers
Granted, I don’t visit every website on earth, but I’ve had zero crashes and no poorly rendered sites using Safari for Windows at work (3 or 301). All and all, just as great and stable as it is on my Mac, but I’m glad I only have to use it at work!
Apple obviously had this update for Windows Safari ready BEFORE the initial release. People in the media talking about bugs and then Apple releasing a bug fix so fast (including security fixes) is all a ploy to get more free publicity. Do you think Apple actually found, fixed, and tested these bugs in three days? Apple is so smart…
I redownloaded Safari 3 (the Mac version) to see if it would work with another PDF plug-in besides Acrobat’s, which kept crashing the beta, and it did. I disabled Acrobat’s and reinstalled one from Schubert-it (it’s available free for personal/educational use here – http://www.schubert-it.com/pluginpdf/ . It had worked great for me in previous versions and seems to be working fine in the beta.
One note, when I reinstalled the beta this time, after using Apple’s uninstaller to remove it last time, my normally-rock-solid computer crashed on startup twice. I had to force fsck it (it’s journaled) and reboot to get it running again, even though the fsck didn’t note anything wrong. The first time I installed it the computer restarted fine. Anyone else have problems restarting?
Paul – done!
MW – took – as in it only took me a minute to show that idiot how stupid he was!
When Microsoft releases software with bugs they call it the finished product and tell you to buy security software.
Why are they increasing the rev number if it’s still in beta? The security patches should have been released as Safari 3 beta rev 2.
why the hell does safari disappear all titles and for example the name people use to post(here)? My igoogle looks HORRIBLE i cant use it nor google news, everything is different
i love mac and im waiting for dad to buy me one, but, this sucks!
The fact that these vulnerabilities were fixed in a matter of days will not be noticed amongst the din of the fact that they were there in the first place.
The Apple Hate is strong. Look at what happens when they have nothing to complain about. They will make shit up. Like all the idiots that, year after year, moan and bitch about the lack of hardware announcements at a developers conference and pretend this is some indicator that Apple is tired or unable to keep up the pace of development.