PT-2006-6867 · Apple · Safari

Published 2006-12-03 · Updated 2008-09-05 · CVE-2006-6238

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari version 2.0.4

Description The issue concerns the AutoFill feature, which does not properly verify the visibility of automatically populated form fields to the user. This allows remote attackers to obtain sensitive information, such as usernames and passwords, via input fields of zero width.

Recommendations For Apple Safari version 2.0.4, consider disabling the AutoFill feature as a temporary workaround until a patch is available. Restrict access to sensitive information by avoiding the use of AutoFill for secure form fields.

Exploit

Fix

Related Identifiers

CVE-2006-6238

Affected Products

Safari

References · 4

• 🔥 http://securityfocus.com/bid/21329 · Exploit
• 🔥 http://tearesolutions.com/2006/11/how_to_steal_passwords_from_safaris_autofill.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6238 · Security Note
• http://secunia.com/advisories/23066 · Vendor Advisory