Executive Summary

Summary
Title Apple Safari code execution vulnerability
Informations
Name VU#905292 First vendor Publication 2007-12-18
Vendor VU-CERT Last vendor Modification 2008-01-07
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#905292

Apple Safari code execution vulnerability

Overview

The Apple Safari web browser contains a vulnerability that may allow an attacker to execute arbitrary code.

I. Description

Per Apple Security Update 2007-009:

    A memory corruption issue exists in Safari's handling of feed: URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of feed: URLs and providing an error message in case of an invalid URL. This issue does not affect systems running Mac OS X 10.5 or later.

II. Impact

A remote unauthenticated attacker who can persuade a user to click on a malicious hyperlink may be able to execute arbitrary code. Note that per Apple Security Update 2007-009 this vulnerability only affects versions of Safari shipped with Mac OS X 10.4 and earlier.

III. Solution

Update

Apple has released an update to address this issue. See Apple Security Update 2007-009for more information on obtaining updates.

Systems Affected

VendorStatusDate Updated
Apple Computer, Inc.Vulnerable18-Dec-2007

References


http://docs.info.apple.com/article.html?artnum=307179

Credit

Information available in About Security Update 2007-009 was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public12/18/2007
Date First Published12/18/2007 09:07:02 AM
Date Last Updated01/07/2008
CERT Advisory 
CVE NameCVE-2007-5859
Metric3.85
Document Revision12

Original Source

Url : http://www.kb.cert.org/vuls/id/905292

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2010-05-12 Name : Mac OS X Security Update 2007-009
File : nvt/macosx_secupd_2007-009.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
40724 Apple Mac OS X Safari RSS Crafted feed: URL Remote Memory Corruption Arbitrar...

A memory corruption flaw exists in Mac OS X. Safari fails to validate feed: URLS resulting in a memory corruption. With a specially crafted URL, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Nessus® Vulnerability Scanner

Date Description
2007-12-18 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2007-009.nasl - Type : ACT_GATHER_INFO