Apple iOS and Mac OS X CFNetwork Cross Domain Information Disclosure Vulnerability

Bugtraq ID:	50115
Class:	Origin Validation Error
CVE:	CVE-2011-3246
Remote:	Yes
Local:	No
Published:	Oct 12 2011 12:00AM
Updated:	Feb 02 2012 12:50AM
Credit:	<br>Erling Ellingsen of Facebook
Vulnerable:	Apple Mac Os X Server 10.7.2 Apple Mac Os X Server 10.7.1 Apple Mac Os X Server 10.7 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0
Not Vulnerable:	Apple Mac Os X Server 10.7.3 Apple Mac Os X Server 10.7.2 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.2 Apple iOS 5.0.1

Apple iOS and Mac OS X CFNetwork Cross Domain Information Disclosure Vulnerability

Apple iOS and Mac OS X are prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to obtain sensitive information related to an arbitrary domain by enticing a victim to visit a maliciously crafted website.

NOTE: This issue was previously discussed in BID 50085 (Apple Mac OS X Prior to 10.7.2 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple iOS and Mac OS X CFNetwork Cross Domain Information Disclosure Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to visit a malicious website.

Apple iOS and Mac OS X CFNetwork Cross Domain Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac Os X Server 10.7.2

• Apple MacOSXServerUpd10.7.3.dmg
  For OS X Lion Server v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac Os X 10.7.1

• Apple MacOSXUpd10.7.2.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.7.3.dmg
  For OS X Lion v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac Os X 10.7.2

• Apple MacOSXUpd10.7.3.dmg
  For OS X Lion v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.7

• Apple MacOSXServerUpdCombo10.7.2.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.7.1

• Apple MacOSXServerUpd10.7.2.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple iOS and Mac OS X CFNetwork Cross Domain Information Disclosure Vulnerability

References:

• Apple Homepage (Apple)
  
• Apple iOS Homepage (Apple)
  
• Mac OS X Homepage (Apple)