Apple Safari Error Page Address Bar URI Spoofing Vulnerability
BID:35829
Info
Apple Safari Error Page Address Bar URI Spoofing Vulnerability
| Bugtraq ID: | 35829 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 27 2009 12:00AM |
| Updated: | Jul 27 2009 11:05PM |
| Credit: | Juan Pablo Lopez Yacubian and Michael Wood |
| Vulnerable: |
Apple Safari 4.0.1 |
| Not Vulnerable: | |
Discussion
Apple Safari Error Page Address Bar URI Spoofing Vulnerability
Apple Safari is affected by a URI-spoofing vulnerability.
An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.
Safari 4.0.1 is affected; other versions may also be vulnerable.
This issue is similar to the vulnerability discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability).
Apple Safari is affected by a URI-spoofing vulnerability.
An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.
Safari 4.0.1 is affected; other versions may also be vulnerable.
This issue is similar to the vulnerability discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability).
Exploit / POC
Apple Safari Error Page Address Bar URI Spoofing Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.
The following example is available:
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.
The following example is available:
Solution / Fix
Apple Safari Error Page Address Bar URI Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Apple Safari Error Page Address Bar URI Spoofing Vulnerability
References:
References: