PT-2007-3734 · Apple · Iphone+1

Published 2007-06-25 · Updated 2022-08-09 · CVE-2007-2401

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.9 through 10.4.9 and later iPhone version before 1.0.1

Description The issue allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request. This is possible because the LF characters are not filtered when serializing headers via the setRequestHeader function. This can be leveraged for cross-site scripting (XSS) attacks.

Recommendations For Apple Mac OS X versions 10.3.9 through 10.4.9 and later, update to a version that includes a fix for this issue. For iPhone version before 1.0.1, update to version 1.0.1 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-2401

Affected Products

Macos X

Iphone

References · 17

• 🔥 https://exploit-db.com/exploits/30228 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2401 · Security Note
• http://secunia.com/advisories/26287 · Vendor Advisory
• http://securityfocus.com/bid/24598 · Patch
• http://westpoint.ltd.uk/advisories/wp-07-0002.txt · Vendor Advisory
• http://securitytracker.com/id?1018281 · Patch
• http://secunia.com/advisories/25786 · Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=306173 · Note
• http://vupen.com/english/advisories/2007/2731 · Note
• http://vupen.com/english/advisories/2007/2296 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35017 · Note
• http://kb.cert.org/vuls/id/845708 · Note
• http://vupen.com/english/advisories/2007/2316 · Note
• http://securityfocus.com/archive/1/472198/100/0/threaded · Note
• http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html · Patch, Vendor Advisory