Malware writers may be delighted with Safari for Windows

Safari for Windows is only a public beta, which is just as well. Security researchers and malware writers explored it with some relish, and Thor Larholm proclaimed: Safari for Windows, 0day exploit in 2 hours. He notes:

URL protocol handlers on the Windows platform work by executing a process with specific command line arguments. When Apple released Safari for the Windows platform they neglected to implement a proper level of input validation for these arguments, which means that you can break out of the intended confines and wreak havoc.

David Maynor at Errata Security reports that "Using publicly available tools we had a DoS in no time."

I'd like to note that we found a totl of 6 bugs in an afternoon, 4 DoS and 2 remote code execution bugs. We have weaponized one of those to be reliable and its diffrent that what Thor has found. The exploit is robust mostly thanks to the lack of any kind of adanced security features in OS X.