PT-2005-2000 · Omni Group+1 · Omniweb+2

David Remahl · Publicado 2005-04-18 · Atualizado 2008-09-05 · CVE-2005-0976

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AppleWebKit (WebCore and WebKit) versions used in Safari 1.2 and OmniGroup OmniWeb 5.1

Description The issue allows remote attackers to read arbitrary files via the XMLHttpRequest Javascript component. This can be achieved by using automatically mounted disk images and file:// URLs.

Recommendations For AppleWebKit (WebCore and WebKit) versions used in Safari 1.2 and OmniGroup OmniWeb 5.1, consider disabling the XMLHttpRequest Javascript component as a temporary workaround until a patch is available. Restrict access to file:// URLs to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0976

Produtos afetados

Apple Webkit

Omniweb

Safari

Referências · 3

• 🔥 http://remahl.se/david/vuln/001 · Exploit
• http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0976 · Nota de Segurança