PT-2005-1314 · Apple · Safari

Eric Johanson · Published 2005-02-07 · Updated 2017-07-11 · CVE-2005-0234

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Safari version 1.2.5

Description The issue allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates. This is done in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Recommendations For Safari version 1.2.5, consider disabling the International Domain Name (IDN) support as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-0234

Affected Products

Safari

References · 9

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Exploit
• 🔥 http://shmoo.com/idn · Exploit
• http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0234 · Security Note
• http://shmoo.com/idn/homograph.txt · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19236 · Note
• http://securityfocus.com/bid/12461 · Note
• http://xforce.iss.net/xforce/xfdb/19236 · Note
• http://marc.info/?l=bugtraq&m=110782704923280&w=2 · Note