Slashdot Log In
Safari 3.1 For Windows Violates Its Own EULA, Vulnerable To Hacks
Posted by
Zonk
on Thursday March 27, @08:45AM
from the you-have-chosen-poorly dept.
from the you-have-chosen-poorly dept.
recoiledsnake writes "The new Safari 3.1 for Windows has been hit with two 'highly critical'(as rated by Secunia) vulnerabilities that can result in execution of arbitrary code. The first is due to an improper handling of the buffer for long filenames of files being downloaded, and the second can result in successful spoofing of websites and phishing. This comes close on the heels of criticism of Apple for offering Safari as a update for approximately 500 million users of iTunes on Windows by default, and reports of crashes. There are currently no patches or workarounds available except the advice to stay clear of 'untrusted' sites." Further, Wormfan writes "The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs." Update: 03/27 17:23 GMT by Z : Dave Schroeder writes with the note that the license has been updated to correct this mistake.
Related Stories
[+]
Mozilla CEO Objects To Safari Auto Install 766 comments
hairyfeet writes "Do you use iTunes on Windows? If so you may be getting the gift of Safari from Apple whether you want it or not, and Mozilla CEO John Lilly is not happy about it. After his daughter was offered Safari as a 'bonus update' with a recent update to her iTunes software, Mr. Lilly says on his blog, 'What Apple is doing now with their Apple Software Update on Windows is wrong. It undermines the trust relationship great companies have with their customers, and that's bad — not just for Apple, but for the security of the whole Web.' He also pointed out the check box is already clicked when you go to update meaning you have to opt out, not in and that it lists Safari as getting an update even if you don't have it installed." Update: 03/21 21:44 GMT by KD : Corrected the name of the Mozilla CEO; also linked directly to his blog.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Acidity (Score:5, Funny)
Re:Acidity (Score:5, Funny)
Yet more proof (Score:5, Funny)
Some ideas are not so good (Score:5, Insightful)
I wonder... (Score:5, Funny)
It was bound to happen (Score:5, Insightful)
I am waiting for the EULA that requires all users to declare the programmer their god and send off their first born child to him in sacrifice.
Re:It was bound to happen (Score:5, Interesting)
See paragraphs 2 and 3 in the LIMITATION OF LIABILITY section.
Violating the EULA (Score:5, Interesting)
When I go to best buy I don't "license" an OS or piece of software; I pick a box up off the shelf, pay money for it and am delivered a purchase reciept. I then own the goods that I just BOUGHT. I am under no statutory obligation to read anything or sign anything. I tear open the box and do what I want with it, short of violating copyright law.
Your EULA is fiction, and until I see one stand up in court I'm going to ignore it.
-mcgrew
Re:Violating the EULA (Score:5, Insightful)
You can stop ignoring them (Score:5, Interesting)
"ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir., 1996), is a United States contract case involving a "shrink wrap license". The issue presented to the court was whether a shrink wrap license was valid and enforceable. Judge Easterbrook wrote the opinion for the court and found such a license was valid and enforceable."
They've been held up in court. The issue isn't totally decided, with other cases dealing with more specific issues, but your "nah nah nah MARY HAD A LITTLE LAMB nah nah nah" fingers in the ears stance may not be legally prudent.
Re:Violating the EULA (Score:5, Informative)
The whole section on enforcability starts with "The enforceability of an EULA depends on several factors, one of them being the court in which the case is heard. Some courts that have addressed the validity of the shrinkwrap license agreements have found some EULAs to be invalid, characterizing them as contracts of adhesion, unconscionable, and/or unacceptable pursuant to the U.C.C." If you read between the lines, it says "No court has rejected EULAs outright". If you're outside the US, it seems to be much the same. Yes, Germany declared the bundling with Windows to be unenforcable, but the EULA as such still remains. In short, you're talking about the way you want it to be not legal reality except possibly in Kansas where there was a ruling agreeing with you.
Fine by me (Score:5, Funny)
Profit? (Score:5, Funny)
Step 2: Sue non-Mac owning PC users for violating EULA
Step 3: ???
A buffer overflow? In 2008? Seriously? (Score:5, Interesting)
Man, they're not even trying are they? This day an age, not only is there no excuse to ship with such a basic flaw, there's really no excuse to be programming in a fashion that would allow it. It's so easy to audit for basic overflows (at least on Windows) that it's silly. Even just compiling /GS with VC++ should protect you against a lot. Seriously, people give MS a bad rap these days, but any exploit you're going to see in their software these days usually takes advantage of complex system interactions or odd exception throwing.
Apple should take a serious look at their coding practices and consider banning the use of unsafe CRT functions and using _s versions of any C functions their using (Visual C++ has them and they're part of the next standard) or at a minimum requiring audits of all raw pointers. Static analysis tools should also be mandatory and should catch most issues.(http://www.spinroot.com/static/)
Re:It has begun... (Score:5, Funny)
Re:It has begun... (Score:5, Funny)
I went down to engineering and got one of the old metal Sun logos, the ones that used to be on the front of Sun-2 boxes, and put it over the logo of the laptop, fired it up in my office, and waited for the first victim to wander by. A while later, one of the senior software developers walked into my office to ask me something, and spied the laptop with the Sun logo and the screensaver running with the Sun logo on it. "How'd you get a Sparc laptop? I didn't think they were in production yet!" I have lots of friends
It didn't take long for the prank to be found out, but it sure was fun for a while...
Reminds me of the time that I got Wine running under A/UX (Apple's version of UNIX, SVR4 flavor) - I was working for Apple at the time, and it was fun to see people's faces when they'd come by and see the Windows logo on the screen on what was obviously a Mac, but that's a story for another time. Sure was a fair bit of work, but it worth the prank value...
Re:It has begun... (Score:5, Insightful)
You don't even have to use apple-firmware in your ipod. There's an upgrade-firmware [rockbox.org] that makes itunes totally obsolete.
It's not available for all ipod-models yet though...
All in all, though, an installer that offers the option of installing irrelevant software (like installers that offer "google toolbar" or "Safari" or "superduper spywareinstaller") should have that option unselected as default.
Re:It has begun... (Score:5, Interesting)
People are having software that they have no license to use being automatically installed on their systems. I would think a term like that is not valid (non-obvious terms may not be valid in the US), but if it does hold, they will have millions of people in the US infringing on their IP. If they decide they are desperate and start suing (not likely any time soon) there are a lot of potential targets.
This is like the RIAA giving away MP3s on their website, saying "you agree to listen to this on only RIAA approved devices". When you suddenly have millions of people acting innocently illegally using your product it is not good for them.
Re:It has begun... (Score:5, Insightful)
Oh blow me. Can you imagine the shitstorm of a comment thread that would result from this exact same thing being the result of MS's doing? The massive gaping security hole *is* a big deal, it is not made less so just because Apple did it and not MS.
And what the hell are you talking about with MS giving guidelines? You mean like, MS should give you guidelines on what you should and should not do with your PC? Dude, seriously, where the hell did you come up with your ideas?
Re:It has begun... (Score:5, Funny)
Good god, man! We've got to get them back on Internet Explorer!
Re:You keep saying that word.... (Score:5, Funny)
Re:It has begun... (Score:5, Informative)
Anyone who installs Apple software had better be prepared to join the cult, otherwise stay the hell clear of it.
Download the installer. Run cabextract on it. You'll get the following files:
AppleSoftwareUpdate.msi
QuickTime.msi
QuickTimeInstallerAdmin.exe
Only install Qucktime.msi. Delete the others. Just do msiexec
Then run this registry file:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
Make sure to delete the shortcuts so users can't bring it up. Doing it this way will let the browser plugins work, and also enable software that uses quicktime to work (lots of educational software uses it) without being hostile to your system. It will only take the quicktime file extensions this way.
I think you're not reading closely enough (Score:5, Informative)
I got Safari as part of the iTunes update. I have a non-Apple Windows machine, running Safari. They basically forced the software on me, and the EULA says I can't use it.
Does that answer your question?
Re:Hardly surprising (Score:5, Interesting)
Seriously though, Apple is allowed legaly for said reason, but I never understood why people accept it... I mean, last I checked, when Microsoft -started- doing that crap, they weren't a monopoly either...and look where it got us.
That being said...watching a media player (iTune)conflict with a RAID (I swear Ive seen that happen) is quite amusing... Just exactly WHAT is that stupid thing doing anyway?
Re:Hardly surprising (Score:5, Informative)
That "spyware" service you refer to is just a notifier to open iTunes when an iPod is connected. That's all it does. It's hardly malicious, and it doesn't report to Apple what you do with your computer.