Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5152 Address Bar URI Spoofing Vulnerability

Bugtraq ID:	62543
Class:	Design Error
CVE:	CVE-2013-5152
Remote:	Yes
Local:	No
Published:	Sep 18 2013 12:00AM
Updated:	Sep 18 2013 12:00AM
Credit:	Keita Haga of keitahaga.com and Lukasz Pilorz of RBS
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:	Apple iOS 7

Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5152 Address Bar URI Spoofing Vulnerability

Apple iOS for the iPhone, the iPod touch, and the iPad is prone to a URI-spoofing vulnerability.

An attacker can then display spoofed site contents to the user that seemingly originate from the trusted site. This allows a remote attacker to carry out phishing attacks. Other attacks may be possible.

Note: This issue was previously covered in BID 62491 (Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities), but has been given its own record to better document it.

Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5152 Address Bar URI Spoofing Vulnerability

References:

• About the security content of iOS 7 (Apple)
  
• Apple iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)