RETIRED: Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
BID:50089
Info
RETIRED: Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
| Bugtraq ID: | 50089 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 12 2011 12:00AM |
| Updated: | Oct 17 2011 11:01PM |
| Credit: | Aaron Sigel of vtty.com, Jason Broccardo of Fermi National Accelerator Laboratory, and John Adamczyk |
| Vulnerable: |
Apple Safari 5.0.6 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Beta Apple Safari 4.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 |
| Not Vulnerable: |
Apple Safari 5.1.1 for Windows Apple Safari 5.1.1 |
Discussion
RETIRED: Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2011-10-12-4. These issues affect versions prior to Safari 5.1.1 running on Apple Mac OS X, Windows 7, XP, and Vista.
Attackers can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks may result in a bypass of intended security protections, or remote code execution.
This BID is being retired. The following individual records exist to better document the issues:
50162 Apple Safari CVE-2011-3230 'file://' Remote Code Execution Vulnerability
50163 Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability
50169 Apple Safari SSL Certificates Handling (CVE-2011-3231) Remote Code Execution Vulnerability
50180 WebKit Private Browsing Security Bypass Vulnerability
Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2011-10-12-4. These issues affect versions prior to Safari 5.1.1 running on Apple Mac OS X, Windows 7, XP, and Vista.
Attackers can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks may result in a bypass of intended security protections, or remote code execution.
This BID is being retired. The following individual records exist to better document the issues:
50162 Apple Safari CVE-2011-3230 'file://' Remote Code Execution Vulnerability
50163 Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability
50169 Apple Safari SSL Certificates Handling (CVE-2011-3231) Remote Code Execution Vulnerability
50180 WebKit Private Browsing Security Bypass Vulnerability
Exploit / POC
Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
Solution:
Vendor fixes are available. Please see the referenced advisory for details.
Apple Safari 5.1
Apple Safari 5.1 for Windows
Solution:
Vendor fixes are available. Please see the referenced advisory for details.
Apple Safari 5.1
-
Apple Safari5.1.1Lion.dmg
Safari for OS X Lion v10.7.2
http://www.apple.com/safari/download/ -
Apple Safari5.1.1SnowLeopard.dmg
Safari for Mac OS X v10.6.8
http://www.apple.com/safari/download/
Apple Safari 5.1 for Windows
-
Apple APPLE-SA-2011-10-12-4 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2011-10-12-4 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2011-10-12-4 SafariSetup.exe
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/
References
Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities
References:
References:
- Apple Safari Homepage (Apple)