Apple published a fixed version of Safari web browser that closes AutoFill hole. User's data from Safari 4 and 5 may be easily stolen via JavaScript.

An attacker has to establish a malicious website with different form fields and run JavaScript that tries to find the first letter for each field. When the first letter is found it triggers browser's autocomplete mechanism to complete the field.

An attack may be even invisible for a victim because it is possible to use invisible forms.

During Black Hat conference researchers promised to provide public with details of the attack, so Apple decided to publish Safari 5. The new version patches multiple flaws, including 14 vulnerabilities in WebKit engine.

Source: SC Magazine
30.07.2010