FKIE_CVE-2009-1706
Vulnerability from fkie_nvd - Published: 2009-06-10 18:00 - Updated: 2025-04-09 00:30
Severity ?
Summary
The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*",
"matchCriteriaId": "7E203D81-FABE-4A63-8930-1DA15A86E113",
"versionEndIncluding": "3.2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*",
"matchCriteriaId": "49875E29-AA30-4D96-9ED9-538823DD5E1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*",
"matchCriteriaId": "D6C733F3-F5D4-4CF1-866D-61FF9D81D1B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*",
"matchCriteriaId": "C5471735-D9C0-491B-9A6A-07B39AA215CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*",
"matchCriteriaId": "1E5C52F3-2109-40FD-9945-A9A9D42C076E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*",
"matchCriteriaId": "151DEB6D-5857-4B0B-8449-5735768024A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*",
"matchCriteriaId": "AC7E7F65-8F3B-42F8-8B2D-9EA1CC4A4300",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*",
"matchCriteriaId": "476EBE1F-66E1-4EF5-8344-BEDA97F306A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*",
"matchCriteriaId": "480ED2AC-0DA4-44DA-A902-8534335077B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*",
"matchCriteriaId": "77F31F4B-5305-4D75-9277-95EF99A969A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*",
"matchCriteriaId": "C9AD216D-0C95-4843-A1A1-C3C9A6219277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*",
"matchCriteriaId": "04B8652D-BE06-49CB-A636-8B53B2DF9168",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie."
},
{
"lang": "es",
"value": "La caracter\u00edstica de Navegaci\u00f3n Privada de Apple Safari anterior a v4.0 en Windows no elimina las cookies del almacenamiento de cookies alternativo en circunstancias no especificadas en relaci\u00f3n con (1) la desactivaci\u00f3n de la caracter\u00edstica o (2) la salida de la aplicaci\u00f3n, esto hace que sea m\u00e1s sencillo a los servidores Web remotos seguir a los usuarios mediante una cookie."
}
],
"id": "CVE-2009-1706",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-06-10T18:00:00.670",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/54997"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35379"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://support.apple.com/kb/HT3613"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/35260"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/35346"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/1522"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/54997"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35379"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://support.apple.com/kb/HT3613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/35260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/35346"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/1522"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…