PT-2010-5097 · Apple+2 · Macos X+3
Huzaifa S. Sidhpurwala
·
Publicado
2010-11-20
·
Atualizado
2017-09-19
·
CVE-2010-3813
CVSS v2.0
5.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apple Safari versions prior to 5.0.3 on Mac OS X 10.5 through 10.6 and Windows
Apple Safari versions prior to 4.1.3 on Mac OS X 10.4
webkitgtk versions prior to 1.2.6
Description
The issue allows remote attackers to bypass intended access restrictions by processing an HTML LINK element without verifying whether DNS prefetching is enabled. This can be demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality, effectively bypassing the DNS prefetching setting.
Recommendations
For Apple Safari versions prior to 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, update to version 5.0.3 or later.
For Apple Safari versions prior to 4.1.3 on Mac OS X 10.4, update to version 4.1.3 or later.
For webkitgtk versions prior to 1.2.6, update to version 1.2.6 or later.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Macos X
Red Hat
Safari
Webkitgtk