Apple Safari RSS Feed Information Disclosure Vulnerability
BID:42039
Info
Apple Safari RSS Feed Information Disclosure Vulnerability
| Bugtraq ID: | 42039 |
| Class: | Design Error |
| CVE: |
CVE-2010-1778 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2010 12:00AM |
| Updated: | Jul 28 2010 12:00AM |
| Credit: | Billy Rios of the Google Security Team |
| Vulnerable: |
Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 |
| Not Vulnerable: |
Apple Safari 5.0.1 Apple Safari 4.1.1 |
Discussion
Apple Safari RSS Feed Information Disclosure Vulnerability
Apple Safari is prone to a remote information-disclosure vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a malicious RSS feed. Successful exploits will allow attackers to gain access to sensitive information.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Apple Safari is prone to a remote information-disclosure vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a malicious RSS feed. Successful exploits will allow attackers to gain access to sensitive information.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
Apple Safari RSS Feed Information Disclosure Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple Safari RSS Feed Information Disclosure Vulnerability
Solution:
Updates are available. Please see the referenced advisory for details.
Apple Safari 5.0 for Windows
Apple Safari 5.0
Apple Safari 4.1
Solution:
Updates are available. Please see the referenced advisory for details.
Apple Safari 5.0 for Windows
-
Apple APPLE-SA-2010-07-28-1
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/
Apple Safari 5.0
-
Apple Safari5.0.1Leopard.dmg
Safari for Mac OS X v10.5.8
http://www.apple.com/safari/download/ -
Apple Safari5.0.1SnowLeopard.dmg
Safari for Mac OS X v10.6.2 and later
http://www.apple.com/safari/download/
Apple Safari 4.1
-
Apple APPLE-SA-2010-07-28-1
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple Safari4.1.1Tiger.dmg
Safari for Mac OS X v10.4.11
http://www.apple.com/safari/download/
References
Apple Safari RSS Feed Information Disclosure Vulnerability
References:
References:
- Apple Safari Homepage (Apple)