PT-2009-2817 · Apple+1 · Safari+2

Publicado 2009-01-15 · Atualizado 2017-08-08 · CVE-2009-0123

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari on Mac OS X 10.5 and Windows

Description The issue is related to the handling of RSS feed URLs in Apple Safari, allowing remote attackers to read arbitrary files on a client machine. This can be exploited to gain access to sensitive information or execute arbitrary script code in the local security zone. The vulnerability is associated with the feed, feeds, and feedsearch URL types for RSS feeds.

Recommendations For Apple Safari on Mac OS X 10.5 and Windows, consider disabling the handling of RSS feed URLs as a temporary workaround until a patch is available. Restrict access to sensitive information and avoid using Safari for handling RSS feeds until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-0123

Produtos afetados

Safari

Macos X

Windows

Referências · 8

• http://secunia.com/advisories/33458 · Nota
• http://isc.sans.org/diary.html?storyid=5689 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47917 · Nota
• http://xforce.iss.net/xforce/xfdb/47917 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0123 · Nota de Segurança
• http://brian.mastenbrook.net/display/27 · Nota
• http://securityfocus.com/bid/33234 · Nota
• http://securitytracker.com/id?1021581 · Nota