PT-2007-3731 · Apple · Safari

Publicado 2007-06-21 · Atualizado 2018-10-16 · CVE-2007-2398

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari version 3.0.1 beta (522.12.12)

Description The issue allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content. This is achieved by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks.

Recommendations For Apple Safari version 3.0.1 beta (522.12.12), consider disabling the use of setTimeout() function in conjunction with location bar settings to minimize the risk of exploitation until a patch is available. Restrict access to modifying the window title and address bar to prevent arbitrary content filling.

Correção

Identificadores relacionados

CVE-2007-2398

Produtos afetados

Safari

Referências · 14

• http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/471452/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/0979/references · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html · Nota
• http://securityfocus.com/archive/1/471454/100/0/threaded · Nota
• http://support.apple.com/kb/HT1467 · Nota
• http://xforce.iss.net/xforce/xfdb/35050 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2398 · Nota de Segurança
• http://vupen.com/english/advisories/2007/2316 · Nota
• http://securityfocus.com/bid/24484 · Nota
• http://securitytracker.com/id?1018282 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35050 · Nota
• http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html · Aviso do Fabricante
• http://osvdb.org/38862 · Nota