Apple Safari Tabbed Browsing Information Disclosure Vulnerability

Bugtraq ID:	26447
Class:	Design Error
CVE:	CVE-2007-4692
Remote:	Yes
Local:	No
Published:	Nov 14 2007 12:00AM
Updated:	Nov 15 2007 06:54PM
Credit:	Michael Roitzsch of Technical University Dresden is credited with discovering this issue.
Vulnerable:	Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 3 Beta for Windows Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4
Not Vulnerable:	Apple Safari 3.0.4 Beta for Windows

Apple Safari Tabbed Browsing Information Disclosure Vulnerability

Apple Safari is prone to an information-disclosure vulnerability because of a design issue related to tabbed browsing.

Attackers may be able to access user credentials or other potentially sensitive information that would aid in phishing attacks.

Apple Safari Tabbed Browsing Information Disclosure Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious website.

Apple Safari Tabbed Browsing Information Disclosure Vulnerability

Solution:
The vendor has issued updates to address this issue. Please see the referenced advisories for more information.

Apple Safari Tabbed Browsing Information Disclosure Vulnerability

References:

• Safari 3 Download Page (Apple)
  
• Safari Homepage (Apple)