PT-2009-5161 · Apple · Webkit+2

James A. T. Rice · Published 2009-09-10 · Updated 2018-11-16 · CVE-2009-2797

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Safari versions prior to 3.1 Safari version prior to 3.1.1 for iPod touch

Description The issue concerns the WebKit component in Safari, which fails to remove usernames and passwords from URLs sent in Referer headers. This allows remote attackers to obtain sensitive information by reading Referer logs on a web server.

Recommendations For Safari versions prior to 3.1, update to version 3.1 or later. For Safari version prior to 3.1.1 for iPod touch, update to version 3.1.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-2797

Affected Products

Safari

Webkit

Ipod Touch

References · 15

• https://osv.dev/vulnerability/CVE-2009-2797 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:039 · Vendor Advisory
• http://support.apple.com/kb/HT3860 · Vendor Advisory
• http://ubuntu.com/usn/USN-1006-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2797 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://vupen.com/english/advisories/2011/0552 · Note
• http://secunia.com/advisories/41856 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53187 · Note
• http://secunia.com/advisories/36677 · Note
• http://secunia.com/advisories/43068 · Note
• http://vupen.com/english/advisories/2010/2722 · Note
• http://securityfocus.com/bid/36339 · Note
• http://vupen.com/english/advisories/2011/0212 · Note