PT-2007-3731 · Apple · Safari

Published 2007-06-21 · Updated 2018-10-16 · CVE-2007-2398

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari version 3.0.1 beta (522.12.12)

Description The issue allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content. This is achieved by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks.

Recommendations For Apple Safari version 3.0.1 beta (522.12.12), consider disabling the use of setTimeout() function in conjunction with location bar settings to minimize the risk of exploitation until a patch is available. Restrict access to modifying the window title and address bar to prevent arbitrary content filling.

Fix

Related Identifiers

CVE-2007-2398

Affected Products

Safari

References · 14

• http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2398 · Security Note
• http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html · Vendor Advisory
• http://securityfocus.com/archive/1/471452/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/0979/references · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0311.html · Note
• http://securityfocus.com/archive/1/471454/100/0/threaded · Note
• http://support.apple.com/kb/HT1467 · Note
• http://xforce.iss.net/xforce/xfdb/35050 · Note
• http://vupen.com/english/advisories/2007/2316 · Note
• http://securityfocus.com/bid/24484 · Note
• http://securitytracker.com/id?1018282 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35050 · Note
• http://osvdb.org/38862 · Note