Details of VAR-200806-0424

ID

VAR-200806-0424

CVE

CVE-2008-2306

TITLE

Apple Safari automatically executes downloaded files based on Internet Explorer zone settings

Trust: 0.8

sources: CERT/CC: VU#127185

DESCRIPTION

Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTION_SHELL_EXECUTE_HIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files. Windows Edition Safari Is Internet Explorer There is a problem of automatically executing the downloaded file depending on the setting contents. As a result, a remote attacker may execute arbitrary code. Apple Safari is prone to a remote code-execution vulnerability. Successfully exploiting this issue will allow attackers to run arbitrary code with the privileges of the user running the affected application. This issue affects versions prior to Apple Safari 3.1.2 running on Microsoft Windows XP and Windows Vista. Safari is the web browser bundled by default in the Apple family operating system. ---------------------------------------------------------------------- Want a new job? http://secunia.com/secunia_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/ International Partner Manager - Project Sales in the IT-Security Industry: http://corporate.secunia.com/about_secunia/64/ ---------------------------------------------------------------------- TITLE: Apple Safari for Windows Multiple Vulnerabilities SECUNIA ADVISORY ID: SA30775 VERIFY ADVISORY: http://secunia.com/advisories/30775/ CRITICAL: Highly critical IMPACT: Exposure of sensitive information, System access WHERE: >From remote REVISION: 1.1 originally posted 2008-06-20 SOFTWARE: Safari for Windows 3.x http://secunia.com/product/17978/ DESCRIPTION: Some vulnerabilities and a security issue have been reported in Apple Safari, which can be exploited by malicious people to disclose sensitive information or to compromise a user's system. 1) A boundary error within the handling of BMP and GIF images can be exploited to trigger an out-of-bounds read and disclose content in memory. 3) An unspecified error in the handling of Javascript arrays can be exploited to cause a memory corruption when a user visits a specially crafted web page. SOLUTION: Update to version 3.1.2. http://www.apple.com/support/downloads/safari312forwindows.html PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Gynvael Coldwind, Hispasec 2) Will Dormann, CERT/CC 3) James Urquhart CHANGELOG: 2008-06-20: Added link to US-CERT. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT2092 US-CERT VU#127185: http://www.kb.cert.org/vuls/id/127185 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2008-2306 // CERT/CC: VU#127185 // JVNDB: JVNDB-2008-001467 // BID: 29835 // VULHUB: VHN-32431 // PACKETSTORM: 67541

AFFECTED PRODUCTS

vendor:	apple	model:	safari	scope:	eq	version:	3.0.4	Trust: 1.0
vendor:	apple	model:	safari	scope:	lte	version:	3.1.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.3	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0	Trust: 1.0
vendor:	apple computer	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	apple	model:	safari	scope:	lte	version:	for windows version 3.1.1	Trust: 0.8
vendor:	microsoft	model:	windows vista	scope:	-	version:	-	Trust: 0.6
vendor:	microsoft	model:	windows xp	scope:	-	version:	-	Trust: 0.6
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.1.1	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.4	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.3	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.2	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.1	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	ne	version:	3.1.2	Trust: 0.3

sources: CERT/CC: VU#127185 // BID: 29835 // JVNDB: JVNDB-2008-001467 // CNNVD: CNNVD-200806-301 // NVD: CVE-2008-2306

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2008-2306
value:	HIGH
Trust: 1.0
CARNEGIE MELLON:	VU#127185
value:	8.10
Trust: 0.8
NVD:	CVE-2008-2306
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200806-301
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-32431
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2008-2306
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-32431
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#127185 // VULHUB: VHN-32431 // JVNDB: JVNDB-2008-001467 // CNNVD: CNNVD-200806-301 // NVD: CVE-2008-2306

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-32431 // JVNDB: JVNDB-2008-001467 // NVD: CVE-2008-2306

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200806-301

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-200806-301

CONFIGURATIONS

sources: JVNDB: JVNDB-2008-001467

PATCH

title:

Safari 3.1.2 for Windows

url:

http://support.apple.com/kb/HT2092

Trust: 0.8

sources: JVNDB: JVNDB-2008-001467

EXTERNAL IDS

db:	CERT/CC	id:	VU#127185	Trust: 3.7
db:	NVD	id:	CVE-2008-2306	Trust: 2.8
db:	BID	id:	29835	Trust: 2.0
db:	SECUNIA	id:	30775	Trust: 1.9
db:	SECTRACK	id:	1020329	Trust: 1.7
db:	VUPEN	id:	ADV-2008-1882	Trust: 1.7
db:	JVNDB	id:	JVNDB-2008-001467	Trust: 0.8
db:	CNNVD	id:	CNNVD-200806-301	Trust: 0.7
db:	APPLE	id:	APPLE-SA-2008-06-19	Trust: 0.6
db:	VULHUB	id:	VHN-32431	Trust: 0.1
db:	PACKETSTORM	id:	67541	Trust: 0.1

sources: CERT/CC: VU#127185 // VULHUB: VHN-32431 // BID: 29835 // JVNDB: JVNDB-2008-001467 // PACKETSTORM: 67541 // CNNVD: CNNVD-200806-301 // NVD: CVE-2008-2306

REFERENCES

url:	http://www.kb.cert.org/vuls/id/127185	Trust: 2.9
url:	http://lists.apple.com/archives/security-announce/2008//jun/msg00001.html	Trust: 1.7
url:	http://www.securityfocus.com/bid/29835	Trust: 1.7
url:	http://www.securitytracker.com/id?1020329	Trust: 1.7
url:	http://secunia.com/advisories/30775	Trust: 1.7
url:	http://www.vupen.com/english/advisories/2008/1882/references	Trust: 1.1
url:	http://support.apple.com/kb/ht2092	Trust: 0.9
url:	http://msdn.microsoft.com/en-us/library/ms537183.aspx	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2306	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu127185/index.html	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2306	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2008/1882/references	Trust: 0.6
url:	http://www.apple.com/safari/	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/30775/	Trust: 0.1
url:	http://secunia.com/hardcore_disassembler_and_reverse_engineer/	Trust: 0.1
url:	http://www.apple.com/support/downloads/safari312forwindows.html	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/secunia_security_specialist/	Trust: 0.1
url:	http://corporate.secunia.com/about_secunia/64/	Trust: 0.1
url:	http://secunia.com/product/17978/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#127185 // VULHUB: VHN-32431 // BID: 29835 // JVNDB: JVNDB-2008-001467 // PACKETSTORM: 67541 // CNNVD: CNNVD-200806-301 // NVD: CVE-2008-2306

CREDITS

Will Dormann

Trust: 0.6

sources: CNNVD: CNNVD-200806-301

SOURCES

db:	CERT/CC	id:	VU#127185
db:	VULHUB	id:	VHN-32431
db:	BID	id:	29835
db:	JVNDB	id:	JVNDB-2008-001467
db:	PACKETSTORM	id:	67541
db:	CNNVD	id:	CNNVD-200806-301
db:	NVD	id:	CVE-2008-2306

LAST UPDATE DATE

2025-04-10T22:39:55.168000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#127185	date:	2008-06-20T00:00:00
db:	VULHUB	id:	VHN-32431	date:	2011-03-08T00:00:00
db:	BID	id:	29835	date:	2009-04-29T22:16:00
db:	JVNDB	id:	JVNDB-2008-001467	date:	2008-07-11T00:00:00
db:	CNNVD	id:	CNNVD-200806-301	date:	2008-09-11T00:00:00
db:	NVD	id:	CVE-2008-2306	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#127185	date:	2008-06-20T00:00:00
db:	VULHUB	id:	VHN-32431	date:	2008-06-23T00:00:00
db:	BID	id:	29835	date:	2008-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2008-001467	date:	2008-07-11T00:00:00
db:	PACKETSTORM	id:	67541	date:	2008-06-21T01:11:07
db:	CNNVD	id:	CNNVD-200806-301	date:	2008-06-23T00:00:00
db:	NVD	id:	CVE-2008-2306	date:	2008-06-23T20:41:00