BID:35346

Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability

Info

Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability

Bugtraq ID:	35346
Class:	Design Error
CVE:	CVE-2009-1706
Remote:	No
Local:	Yes
Published:	Jun 08 2009 12:00AM
Updated:	Jun 12 2009 06:39PM
Credit:	Michael Hay of Beatnik Monkey Software
Vulnerable:	Apple Safari For Windows 3.2.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.1 for Windows Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 3.1 for Windows Apple Safari 3 Beta for Windows

Not Vulnerable:	Apple Safari 4 for Windows

Discussion

Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability

Apple Safari is prone to a local information-disclosure vulnerability.

A local attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

This issue affects versions prior to Safari 4.0 running on Microsoft Windows XP and Vista.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

Exploit / POC

Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability

A local attacker can exploit this issue via readily available tools.

Solution / Fix

Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.

Apple Safari 3 Beta for Windows