PT-2009-2817 · Apple+1 · Safari+2

Published 2009-01-15 · Updated 2017-08-08 · CVE-2009-0123

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari on Mac OS X 10.5 and Windows

Description The issue is related to the handling of RSS feed URLs in Apple Safari, allowing remote attackers to read arbitrary files on a client machine. This can be exploited to gain access to sensitive information or execute arbitrary script code in the local security zone. The vulnerability is associated with the feed, feeds, and feedsearch URL types for RSS feeds.

Recommendations For Apple Safari on Mac OS X 10.5 and Windows, consider disabling the handling of RSS feed URLs as a temporary workaround until a patch is available. Restrict access to sensitive information and avoid using Safari for handling RSS feeds until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-0123

Affected Products

Safari

Macos X

Windows

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-0123 · Security Note
• http://secunia.com/advisories/33458 · Note
• http://isc.sans.org/diary.html?storyid=5689 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47917 · Note
• http://xforce.iss.net/xforce/xfdb/47917 · Note
• http://brian.mastenbrook.net/display/27 · Note
• http://securityfocus.com/bid/33234 · Note
• http://securitytracker.com/id?1021581 · Note