Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
BID:62537
Info
Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 62537 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5129 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 18 2013 12:00AM |
| Updated: | Oct 24 2013 12:30AM |
| Credit: | Mario Heiderich |
| Vulnerable: |
Apple iPod Touch 0 Apple iPhone 4.0.1 Apple iPhone 4.3.3 Apple iPhone 4.3.2 Apple iPhone 4.3.1 Apple iPhone 4.3.0 Apple iPhone 4.2.8 Apple iPhone 4.2.5 Apple iPhone 4.2.1 Apple iPhone 4.1 Apple iPhone 4.0.2 Apple iPhone 4.0.1 - Ipodtouch Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 |
| Not Vulnerable: | |
Discussion
Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
Apple iOS for iPhone, iPod touch, and iPad is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 62491 (Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities), but has been given its own record to better document it.
Apple iOS for iPhone, iPod touch, and iPad is prone to a cross-site scripting vulnerability.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 62491 (Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities), but has been given its own record to better document it.
Exploit / POC
Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
References:
References:
- iOS Homepage (Apple)
- iPad Homepage (Apple)
- iPhone Product Page (Apple)
- iPod touch Product Page (Apple)