PT-2005-1314 · Apple · Safari

Eric Johanson · Publicado 2005-02-07 · Atualizado 2017-07-11 · CVE-2005-0234

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Safari version 1.2.5

Description The issue allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates. This is done in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Recommendations For Safari version 1.2.5, consider disabling the International Domain Name (IDN) support as a temporary workaround until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2005-0234

Produtos afetados

Safari

Referências · 9

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Exploit
• 🔥 http://shmoo.com/idn · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19236 · Nota
• http://securityfocus.com/bid/12461 · Nota
• http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/19236 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0234 · Nota de Segurança
• http://shmoo.com/idn/homograph.txt · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110782704923280&w=2 · Nota