PT-2007-5605 · Apple · Safari

Published 2007-08-18 · Updated 2018-10-15 · CVE-2007-4424

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari for Windows versions 3.0.3 and earlier

Description The issue allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. This occurs because the browser does not prompt the user before downloading a file.

Recommendations For Apple Safari for Windows versions 3.0.3 and earlier, consider configuring the browser to prompt users before saving files, or avoid using the browser to access untrusted websites until a fix is available. As a temporary workaround, consider restricting the use of the OBJECT element with the DATA attribute to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-4424

Affected Products

Safari

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4424 · Security Note
• http://securityfocus.com/archive/1/476675/100/0/threaded · Note
• http://securityreason.com/securityalert/3022 · Note
• http://securitytracker.com/id?1018575 · Note
• http://securityfocus.com/archive/1/477180/100/0/threaded · Note
• http://securityfocus.com/archive/1/476690/100/0/threaded · Note