Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-0153 | First vendor Publication | 2009-05-13 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0153 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11366 | |||
| Oval ID: | oval:org.mitre.oval:def:11366 | ||
| Title: | International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Description: | International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0153 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13220 | |||
| Oval ID: | oval:org.mitre.oval:def:13220 | ||
| Title: | USN-846-1 -- icu vulnerability | ||
| Description: | It was discovered that ICU did not properly handle invalid byte sequences during Unicode conversion. If an application using ICU processed crafted data, content security mechanisms could be bypassed, potentially leading to cross-site scripting attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-846-1 CVE-2009-0153 | Version: | 5 |
| Platform(s): | Ubuntu 8.10 Ubuntu 8.04 Ubuntu 9.04 | Product(s): | icu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13272 | |||
| Oval ID: | oval:org.mitre.oval:def:13272 | ||
| Title: | DSA-1889-1 icu -- programming error | ||
| Description: | It was discovered that the ICU unicode library performed incorrect processing of invalid multibyte sequences, resulting in potential bypass of security mechanisms. For the old stable distribution, this problem has been fixed in version 3.6-2etch3. For the stable distribution, this problem has been fixed in version 3.8.1-3+lenny2. For the unstable distribution, this problem has been fixed in version 4.0.1-1. We recommend that you upgrade your icu packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1889-1 CVE-2009-0153 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | icu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22853 | |||
| Oval ID: | oval:org.mitre.oval:def:22853 | ||
| Title: | ELSA-2009:1122: icu security update (Moderate) | ||
| Description: | International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:1122-01 CVE-2009-0153 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | icu |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28965 | |||
| Oval ID: | oval:org.mitre.oval:def:28965 | ||
| Title: | RHSA-2009:1122 -- icu security update (Moderate) | ||
| Description: | Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153) All users of icu should upgrade to these updated packages, which contain backported patches to resolve this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:1122 CESA-2009:1122-CentOS 5 CVE-2009-0153 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | icu |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for icu CESA-2009:1122 centos5 i386 File : nvt/gb_CESA-2009_1122_icu_centos5_i386.nasl |
| 2010-05-12 | Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002 File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-13 | Name : SLES10: Security update for icu File : nvt/sles10_icu.nasl |
| 2009-10-11 | Name : SLES11: Security update for icu File : nvt/sles11_libicu.nasl |
| 2009-09-21 | Name : Debian Security Advisory DSA 1889-1 (icu) File : nvt/deb_1889_1.nasl |
| 2009-09-09 | Name : SuSE Security Summary SUSE-SR:2009:014 File : nvt/suse_sr_2009_014.nasl |
| 2009-06-30 | Name : RedHat Security Advisory RHSA-2009:1122 File : nvt/RHSA_2009_1122.nasl |
| 2009-06-30 | Name : CentOS Security Advisory CESA-2009:1122 (icu) File : nvt/ovcesa2009_1122.nasl |
| 2009-06-23 | Name : Fedora Core 9 FEDORA-2009-6121 (icu) File : nvt/fcore_2009_6121.nasl |
| 2009-06-23 | Name : Fedora Core 10 FEDORA-2009-6273 (icu) File : nvt/fcore_2009_6273.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54447 | Apple Mac OS X International Components for Unicode (ICU) Conversion XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1122.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090625_icu_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-01-04 | Name : The remote server is affected by a signature validation bypass vulnerability. File : openssl_0_9_8j.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1889.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1122.nasl - Type : ACT_GATHER_INFO |
| 2009-10-09 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-846-1.nasl - Type : ACT_GATHER_INFO |
| 2009-10-06 | Name : The remote openSUSE host is missing a security update. File : suse_icu-6322.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_icu-090622.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_icu-6422.nasl - Type : ACT_GATHER_INFO |
| 2009-08-20 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_icu-090622.nasl - Type : ACT_GATHER_INFO |
| 2009-08-20 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_icu-090622.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1122.nasl - Type : ACT_GATHER_INFO |
| 2009-06-16 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6121.nasl - Type : ACT_GATHER_INFO |
| 2009-06-16 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6273.nasl - Type : ACT_GATHER_INFO |
| 2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : safari_4.0.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_7.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:11:21 |
|
| 2024-11-28 12:18:04 |
|
| 2021-05-04 12:09:01 |
|
| 2021-04-22 01:09:21 |
|
| 2020-05-23 00:23:13 |
|
| 2017-09-29 09:24:01 |
|
| 2017-08-08 09:24:39 |
|
| 2016-04-26 18:33:42 |
|
| 2014-02-17 10:48:23 |
|
| 2013-05-10 23:42:16 |
|
