PT-2007-2100 · Apple · Appkit+1

Published 2007-02-01 · Updated 2008-09-05 · CVE-2007-0644

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari version 2.0.4 (419.3)

Description The issue allows remote user-assisted attackers to cause a denial of service, resulting in a crash, by utilizing format string specifiers in filenames. This occurs due to improper handling when calling the NSLog and NSBeginAlertSheet Apple AppKit functions.

Recommendations For Apple Safari version 2.0.4 (419.3), consider avoiding the use of format string specifiers in filenames until a fix is available. As a temporary workaround, restrict the handling of filenames by the NSLog and NSBeginAlertSheet functions to minimize the risk of a denial of service.

Exploit

Fix

Related Identifiers

CVE-2007-0644

Affected Products

Appkit

Safari

References · 5

• 🔥 https://exploit-db.com/exploits/29555 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0644 · Security Note
• http://digitalmunition.com/MOAB-30-01-2007.html · Note
• http://osvdb.org/32710 · Note
• http://securityfocus.com/bid/22326 · Note