PT-2010-1887 · Apple · Macos X+1

Clint Ruoho · Publicado 2010-03-30 · Atualizado 2010-03-31 · CVE-2010-0063

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.6.3

Description The issue allows user-assisted remote attackers to execute arbitrary JavaScript via a web page, making it easier to exploit. This is due to an incomplete blacklist vulnerability in CoreTypes, which does not properly handle certain Content-Type values for Safari. Specifically, the values for the .ibplugin and .url extensions are not on the list of possibly unsafe content types.

Recommendations For Apple Mac OS X versions prior to 10.6.3, update to version 10.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the handling of downloads with Content-Type values that are not explicitly marked as safe in Safari. Avoid using Safari to download files with potentially unsafe content types, such as .ibplugin and .url extensions, until the issue is resolved.

Correção

Identificadores relacionados

CVE-2010-0063

Produtos afetados

Macos X

Safari

Referências · 3

• http://support.apple.com/kb/HT4077 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0063 · Nota de Segurança