PT-2007-5605 · Apple · Safari

Publicado 2007-08-18 · Atualizado 2018-10-15 · CVE-2007-4424

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari for Windows versions 3.0.3 and earlier

Description The issue allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. This occurs because the browser does not prompt the user before downloading a file.

Recommendations For Apple Safari for Windows versions 3.0.3 and earlier, consider configuring the browser to prompt users before saving files, or avoid using the browser to access untrusted websites until a fix is available. As a temporary workaround, consider restricting the use of the OBJECT element with the DATA attribute to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4424

Produtos afetados

Safari

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4424 · Nota de Segurança
• http://securityfocus.com/archive/1/476675/100/0/threaded · Nota
• http://securityreason.com/securityalert/3022 · Nota
• http://securitytracker.com/id?1018575 · Nota
• http://securityfocus.com/archive/1/477180/100/0/threaded · Nota
• http://securityfocus.com/archive/1/476690/100/0/threaded · Nota