Summary
The host is installed with Apple Safari web browser and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attacker to disclose potentially sensitive information, conduct cross-site scripting and spoofing attacks, and compromise a user's system.
Impact Level: Application
Solution
Upgrade to Apple Safari version 5.0.4 or later,
For updates refer to http://www.apple.com/support/downloads/
Insight
- An error in the WebKit component when handling redirects during HTTP Basic Authentication can be exploited to disclose the credentials to another site.
- An error in the WebKit component when handling the Attr.style accessor can be exploited to inject an arbitrary Cascading Style Sheet (CSS) into another document.
- A type checking error in the WebKit component when handling cached resources can be exploited to poison the cache and prevent certain resources from being requested.
- An error in the WebKit component when handling HTML5 drag and drop operations across different origins can be exploited to disclose certain content to another site.
- An error in the tracking of window origins within the WebKit component can be exploited to disclose the content of files to a remote server.
- Input passed to the 'window.console._inspectorCommandLineAPI' property while browsing using the Web Inspector is not properly sanitised before being returned to the user.
Affected
Apple Safari versions prior to 5.0.4
References
Severity
Classification
-
CVE CVE-2011-0160, CVE-2011-0161, CVE-2011-0163, CVE-2011-0166, CVE-2011-0167, CVE-2011-0169 -
CVSS Base Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N
Related Vulnerabilities
- Avant Browser Address Bar Spoofing Vulnerability
- AVG Anti-Virus 'hcp://' Protocol Handler Remote Code Execution Vulnerability
- CA Gateway Security Remote Code Execution Vulnerability
- Adobe Digital Edition Information Disclosure Vulnerability (Mac OS X)
- Adobe Reader Old Plugin Signature Bypass Vulnerability (Windows)