WebKit CVE-2013-0962 Cross Site Scripting Vulnerability

Bugtraq ID:	57583
Class:	Input Validation Error
CVE:	CVE-2013-0962
Remote:	Yes
Local:	No
Published:	Jan 28 2013 12:00AM
Updated:	Jan 28 2013 12:00AM
Credit:	Mario Heiderich of Cure53
Vulnerable:	WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r82222 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit r105591 WebKit Open Source Project WebKit 2 WebKit Open Source Project WebKit 0 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 3.0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 4.3.3 Apple iPhone 4.3.2 Apple iPhone 4.3.1 Apple iPhone 4.3.0 Apple iPhone 4.2.8 Apple iPhone 4.2.5 Apple iPhone 4.2.1 Apple iPhone 4.1 Apple iPhone 4.0.2 Apple iPhone 4.0 Apple iPhone 3.2.2 Apple iPhone 3.2 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1
Not Vulnerable:

WebKit CVE-2013-0962 Cross Site Scripting Vulnerability

WebKit is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Note: This issue was previously covered in BID 57572 (Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities), but has been given its own record to better document it.

WebKit CVE-2013-0962 Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

WebKit CVE-2013-0962 Cross Site Scripting Vulnerability

Solution:
The vendor has fixed the issue. Please see the references for more information.

WebKit CVE-2013-0962 Cross Site Scripting Vulnerability

References:

• iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Homepage (Apple)
  
• iPod touch Product Page (Apple)
  
• WebKit Homepage (WebKit)
  
• About the security content of iOS 6.1 Software Update (Apple)
  
• About the security content of Safari 6.0.3 (Apple)