ID

VAR-201203-0032

CVE

CVE-2012-0584

TITLE

Windows Run on Apple Safari of IDN Domain name spoofing vulnerability

DESCRIPTION

The Internationalized Domain Name (IDN) feature in Apple Safari before 5.1.4 on Windows does not properly restrict the characters in URLs, which allows remote attackers to spoof a domain name via unspecified homoglyphs. An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be presented with a source URI of a trusted site while interacting with the attacker's malicious site. Versions prior to Apple Safari 5.1.4 on Windows systems are vulnerable. Apple Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with Mac OS X and iOS operating systems. This issue is addressed through an improved domain name validity check. This issue does not affect OS X systems. CVE-ID CVE-2012-0584 : Matt Cooley of Symantec Safari Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: Web page visits may be recorded in browser history even when Private Browsing is active Description: Safari's Private Browsing is designed to prevent recording of a browsing session. CVE-ID CVE-2012-0585 : Eric Melville of American Express WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: Multiple cross-site scripting issues existed in WebKit CVE-ID CVE-2011-3881 : Sergey Glazunov CVE-2012-0586 : Sergey Glazunov CVE-2012-0587 : Sergey Glazunov CVE-2012-0588 : Jochen Eisinger of Google Chrome Team CVE-2012-0589 : Alan Austin of polyvore.com WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website may lead to the disclosure of cookies Description: A cross-origin issue existed in WebKit, which may allow cookies to be disclosed across origins. CVE-ID CVE-2011-3887 : Sergey Glazunov WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website and dragging content with the mouse may lead to a cross-site scripting attack Description: A cross-origin issue existed in WebKit, which may allow content to be dragged and dropped across origins. CVE-ID CVE-2012-0590 : Adam Barth of Google Chrome Security Team WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. CVE-ID CVE-2012-0640 : nshah WebKit Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3, Windows 7, Vista, XP SP2 or later Impact: HTTP authentication credentials may be inadvertently disclosed to another site Description: If a site uses HTTP authentication and redirects to another site, the authentication credentials may be sent to the other site. CVE-ID CVE-2012-0647 : an anonymous researcher Safari 5.1.4 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for OS X Lion v10.7.3 The download file is named: Safari5.1.4LionManual.dmg Its SHA-1 digest is: 241bda1dcf34dcdb13e1848c11628173ca7c504f Safari for Mac OS X v10.6.8 The download file is named: Safari5.1.4SnowLeopardManual.dmg Its SHA-1 digest is: 5703ffce7bbf4a283d0b5dec382b762501f8f3d4 Safari for Windows 7, Vista or XP The download file is named: SafariSetup.exe Its SHA-1 digest is: 1a6712411a105b896eed1e1b0940e98f6e65c4f6 Safari for Windows 7, Vista or XP from the Microsoft Choice Screen The download file is named: Safari_Setup.exe Its SHA-1 digest is: 8094f7991ab1820aa35044cb8f5ba74db0a0b37a Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iQEcBAEBAgAGBQJPXifpAAoJEGnF2JsdZQee2GQH/R4lUIveYjpYn7fu7vCyLrUM 5JsmdOO3FOmBiDl4ULrGBdKzss4gGJOERdTCKZeDEFvpQIRzCkcp4w7cKDMoU6Zg DEz1dMQsbpXRQu6ageJ+P12mhDvUJ1dPxesFdMA5SOWrFglf/xz37yRKCM0/3hWq r6LhIaxRgKJjJaNBzWrGifLaOipJYo2X3bBQ1Tt1a79M5iVYbBlX458uop+vuK8H 9Whlriqc2sffmc7VGUBWZ8hSU6SP0S0fxh/A6ygSwqNzaHIl3g41v13tNzhrktmV kJ0Bk7iIaUmT3E3nd4hE4cX8sGj5SBk372UKYE5E2+cxpz2fVSbTwXbo1d6UuWc= =mKMo -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA48377 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48377/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48377 RELEASE DATE: 2012-03-13 DISCUSS ADVISORY: http://secunia.com/advisories/48377/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48377/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48377 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to conduct cross-site scripting and spoofing attacks, bypass certain security restrictions, disclose certain sensitive information, and compromise a user's system. 2) The Private Browsing feature does not properly prevent recording of visits to certain sites implementing the pushState or replaceState JavaScript methods. 3) Multiple errors in the WebKit component can be exploited to conduct cross-site scripting attacks. 4) An error within the WebKit component when handling drag-and-drop actions can be exploited to conduct cross-site scripting attacks. 5) Multiple errors within the WebKit component can be exploited to corrupt memory. Successful exploitation of this vulnerability may allow execution of arbitrary code. 6) An error within the cookie policy does not enforce the "Block Cookies" preference properly and can be exploited to set cookies from third-party sites. 7) An error in the WebKit component when handling redirects during HTTP Authentication can be exploited to disclose the credentials to another site. This may be related to: SA40110 SOLUTION: Update to version 5.1.4. PROVIDED AND/OR DISCOVERED BY: 5) Reported by the vendor. The vendor also credits miaubiz, Martin Barbella, Alexander Gavrun via ZDI, Lei Zhang of the Chromium development community, Adam Klein of the Chromium development community, Abhishek Arya (Inferno) of Google Chrome Security Team, Sergey Glazunov, Dmytro Gorbunov of SaveSources.com, Marshall Greenblatt, Dharani Govindan of Google Chrome, Aki Helin of OUSPG, Dave Levin, Slawomir Blazek, Sergio Villar Senin of Igalia, Cris Neckar of the Google Chrome Security Team, Julien Chaffraix of the Chromium development community, and Jeremy Apthorp of Google. The vendor credits: 1) Matt Cooley, Symantec 2) Eric Melville, American Express 3) Sergey Glazunov, Jochen Eisinger of Google Chrome Security Team, and Alan Austin of polyvore.com 4) Adam Barth, Google Chrome Security Team 6) nshah 7) An anonymous person ORIGINAL ADVISORY: http://support.apple.com/kb/HT5190 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Matt Cooley of Symantec

SOURCES

LAST UPDATE DATE

2025-04-11T20:03:12.898000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE