ID

VAR-201103-0268

CVE

CVE-2011-0167

TITLE

Apple Safari Windows function vulnerable to arbitrary local file transmission

DESCRIPTION

The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary local files from a client computer, via a crafted web site. WebKit is prone to a cross-domain scripting vulnerability because it fails to properly enforce the same-origin policy. Successfully exploiting this issue will allow attackers to send the content of arbitrary files from the user's system to a remote server controlled by them. This results in disclosure of potentially sensitive information which may aid in further attacks. Apple Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with Mac OS X and iOS operating systems. A vulnerability exists in a windows functionality in WebKit versions of Apple Safari prior to 5.0.4. ---------------------------------------------------------------------- Get a tax break on purchases of Secunia Solutions! If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at: http://secunia.com/products/corporate/vim/section_179/ ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA43696 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43696/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43696 RELEASE DATE: 2011-03-11 DISCUSS ADVISORY: http://secunia.com/advisories/43696/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/43696/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=43696 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to disclose potentially sensitive information, conduct cross-site scripting and spoofing attacks, and compromise a user's system. For more information: SA43582 1) An error in the WebKit component when handling redirects during HTTP Basic Authentication can be exploited to disclose the credentials to another site. This may be related to: SA40110 2) An error in the WebKit component when handling the Attr.style accessor can be exploited to inject an arbitrary Cascading Style Sheet (CSS) into another document. 3) A type checking error in the WebKit component when handling cached resources can be exploited to poison the cache and prevent certain resources from being requested. 4) An error in the WebKit component when handling HTML5 drag and drop operations across different origins can be exploited to disclose certain content to another site. 6) Input passed to the "window.console._inspectorCommandLineAPI" property while browsing using the Web Inspector is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are reported in versions prior to 5.0.4. SOLUTION: Update to version 5.0.4. Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ PROVIDED AND/OR DISCOVERED BY: 2, 3, 6) Reported by the vendor. The vendor also credits: 1) McIntosh Cooey, Twelve Hundred Group 1) Harald Hanche-Olsen 1) Chuck Hohn, 1111 Internet LLC via CERT 1) Paul Hinze, Braintree 4) Michal Zalewski, Google Inc. 5) Aaron Sigel, vtty.com ORIGINAL ADVISORY: http://support.apple.com/kb/HT4566 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Aaron Sigel of vtty.com

SOURCES

LAST UPDATE DATE

2025-04-11T20:58:45.288000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE