WebKit Embedded URL Cross Domain Scripting Vulnerability
BID:48859
Info
WebKit Embedded URL Cross Domain Scripting Vulnerability
| Bugtraq ID: | 48859 |
| Class: | Origin Validation Error |
| CVE: |
CVE-2011-0242 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 20 2011 12:00AM |
| Updated: | Oct 12 2011 10:50PM |
| Credit: | Apple |
| Vulnerable: |
WebKit Open Source Project WebKit 0 Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 |
| Not Vulnerable: |
Apple Safari 5.0.6 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple iOS 5 |
Discussion
WebKit Embedded URL Cross Domain Scripting Vulnerability
WebKit is prone to a cross-domain scripting vulnerability because the application fails to properly enforce the same-origin policy.
Successful exploits will allow attackers to execute arbitrary script code within the context of the affected application.
NOTE: This issue was previously discussed in 48808 (Apple Safari Prior to 5.1 and 5.0.6 Multiple Security
Vulnerabilities) but has been given its own record to better document it.
WebKit is prone to a cross-domain scripting vulnerability because the application fails to properly enforce the same-origin policy.
Successful exploits will allow attackers to execute arbitrary script code within the context of the affected application.
NOTE: This issue was previously discussed in 48808 (Apple Safari Prior to 5.1 and 5.0.6 Multiple Security
Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
WebKit Embedded URL Cross Domain Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.
To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.
Solution / Fix
WebKit Embedded URL Cross Domain Scripting Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
WebKit Embedded URL Cross Domain Scripting Vulnerability
References:
References: