Apple iPhone and iPod touch Safari UI Spoofing Phishing Vulnerability

Bugtraq ID:	45087
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 29 2010 12:00AM
Updated:	Nov 29 2010 12:00AM
Credit:	Nitesh Dhanjani
Vulnerable:	Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 4.1 Apple iPhone 4.0.1 - Ipodtouch Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPhone 3.2.1 - Ipad Apple iPhone 3.2 - Ipodtouch Apple iPhone 3.2 - Iphone Apple iPhone 3.2 Apple iPhone 3.1.3 - Ipodtouch Apple iPhone 3.1.3 - Iphone Apple iPhone 3.1.2 - Ipodtouch Apple iPhone 3.1.2 - Iphone Apple iPhone 3.1 - Ipodtouch Apple iPhone 3.1 - Iphone Apple iPhone 3.1 Apple iPhone 3.0.1 - Ipodtouch Apple iPhone 3.0.1 - Iphone Apple iPhone 3.0 - Ipodtouch Apple iPhone 3.0 - Iphone Apple iPhone 3.0
Not Vulnerable:

Apple iPhone and iPod touch Safari UI Spoofing Phishing Vulnerability

Apple iPhone and iPod touch are prone to a vulnerability that can aid in phishing attacks.

An attacker may exploit this vulnerability to hide the address bar. This issue may allow a remote attacker to carry out phishing-style attacks.

Apple iPhone and iPod touch Safari UI Spoofing Phishing Vulnerability

Attackers can exploit this issue by tricking an unsuspecting victim into visiting a malicious site.

Apple iPhone and iPod touch Safari UI Spoofing Phishing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iPhone and iPod touch Safari UI Spoofing Phishing Vulnerability

References:

• Apple Homepage (Apple)
  
• UI Spoofing Safari on the iPhone (Nitesh Dhanjani)