Apple Safari Shortcut Menu Options Information Disclosure Vulnerability

Bugtraq ID:	36994
Class:	Design Error
CVE:	CVE-2009-2842
Remote:	Yes
Local:	No
Published:	Nov 11 2009 12:00AM
Updated:	Nov 12 2009 06:17PM
Credit:	Apple
Vulnerable:	Apple Safari For Windows 3.2.1 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Beta Apple Safari 4 Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3
Not Vulnerable:	Apple Safari 4.0.4 for Windows Apple Safari 4.0.4

Apple Safari Shortcut Menu Options Information Disclosure Vulnerability

Apple Safari is prone to an information-disclosure vulnerability.

A remote attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

This issue affects versions prior to Safari 4.0.4.

Apple Safari Shortcut Menu Options Information Disclosure Vulnerability

Attackers can exploit this issue by tricking a victim into viewing a specially crafted webpage.

Apple Safari Shortcut Menu Options Information Disclosure Vulnerability

Solution:
Vendor fixes are available. Please see the referenced advisory for details.


Apple Safari 4.0.3 for Windows

• Apple APPLE-SA-2009-11-11-1 SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2009-11-11-1 SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

Apple Safari 4.0.3

• Apple Safari4.0.4Leopard.dmg
  Safari for Mac OS X v10.5.7
  http://www.apple.com/safari/download/


• Apple Safari4.0.4SnowLeopard.dmg
  Safari for Mac OS X v10.6.1 and v10.6.2
  http://www.apple.com/safari/download/


• Apple Safari4.0.4Tiger.dmg
  Safari for Mac OS X v10.4.11
  http://www.apple.com/safari/download/

Apple Safari Shortcut Menu Options Information Disclosure Vulnerability

References:

• Apple Safari Homepage (Apple)