Apple Safari For Windows 'window.open()' URI Spoofing Vulnerability

Bugtraq ID:	52746
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2012 12:00AM
Updated:	Mar 28 2012 12:00AM
Credit:	Lostmon
Vulnerable:	Apple Safari 5.1.5 for Windows
Not Vulnerable:

Apple Safari For Windows 'window.open()' URI Spoofing Vulnerability

Apple Safari for Windows is affected by a URI-spoofing vulnerability.

An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be presented with a source URI of a trusted site while interacting with the attacker's malicious site.

Versions prior to Apple Safari 5.1.5 on Windows systems are vulnerable.

Apple Safari For Windows 'window.open()' URI Spoofing Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/52746.html

Apple Safari For Windows 'window.open()' URI Spoofing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple Safari For Windows 'window.open()' URI Spoofing Vulnerability

References:

• Safari Homepage (Apple)