(Apple Issues New Fix) Apple Safari Bugs Let Remote Users Modify the Address Bar and Conduct Cross-Domain Scripting Attacks
|
|
SecurityTracker Alert ID: 1019871
|
|
SecurityTracker URL: http://securitytracker.com/id?1019871
|
|
CVE Reference: CVE-2007-2398
(Links to External Site)
|
Date: Apr 16 2008
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Apple Security Advisory
|
Version(s): 3.1 and prior versions
|
Description: Two vulnerabilities were reported in Safari. A remote user can modify the address bar. A remote user can conduct cross-domain scripting attacks.
A remote user can create specially crafted HTML that, when loaded by the target user, will modify the contents of the address bar
on the target user's browser [CVE-2007-2398].
Mac OS X systems are not affected by this vulnerability.
Robert Swiecki reported
this vulnerability.
A demonstration exploit is available at:
http://alt.swiecki.net/saff.html
A remote user can create
specially crafted HTML that, when loaded by the target user, will exploit a race condition in the browser to enable Javascript running
in the context of one page to modify a page in a different security domain [CVE-2007-2400].
Both Windows and Mac OS X systems
are affected.
Apple credits Lawrence Lai, Stan Switzer, Ed Rowe of Adobe Systems, Inc with reporting this vulnerability.
|
Impact: A remote user can create HTML that, when loaded by the target user, will modify the address bar on the target user's browser.
A
remote user can access the target user's cookies (including authentication cookies), if any, associated with an arbitrary site,
access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: The vulnerability was corrected in Safari Beta 3.0.2, but reintroduced in Safari 3.1.
The vendor has issued a new fix (3.1.1).
The vendor's advisory is available at:
http://support.apple.com/kb/HT1467
|
Vendor URL: www.apple.com/safari (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: UNIX (OS X), Windows (Vista), Windows (XP)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 16 Apr 2008 16:33:34 -0400
Subject: Apple Safari
|
http://support.apple.com/kb/HT1467
Safari 3.1.1
* Safari
CVE-ID: CVE-2007-2398
Available for: Windows XP or Vista
Impact: A maliciously crafted website may control the contents of the address bar
Description: A timing issue in Safari 3.1 allows a web page to change the contents of the addre
ss bar without loading the contents of the corresponding page. This could be used to spoof the conten
ts of a legitimate site, allowing user credentials
|
|
