jvndb - jvndb-2007-000560

jvndb-2007-000560

Vulnerability from jvndb

Published

2008-05-21 00:00

Modified

2008-05-21 00:00

Severity ?

() - -

Summary

Safari URL spoofing vulnerability

Details

Apple's Safari contains a vulnerability that allows spoofing of URLs in the address bar. Apple's Safari is a web browser installed as default with Mac OS X. There is a problem in Safari where URLs displayed in the address bar could be spoofed to deceive Safari users. This could be conducted by using Unicode characters that look alike to ASCII characters as URL strings.

References

▼	Type	URL
	JVN	http://jvn.jp/en/jp/JVN16018033/index.html
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3742
	NVD	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3742
	BID	http://www.securityfocus.com/bid/24636
	XF	http://xforce.iss.net/xforce/xfdb/35716
	FRSIRT	http://www.frsirt.com/english/advisories/2007/2730
	Resource Management Errors(CWE-399)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Link Following(CWE-59)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Apple Inc.	Safari
	Apple Inc.	iPhone

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000560.html",
  "dc:date": "2008-05-21T00:00+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-05-21T00:00+09:00",
  "description": "Apple\u0027s Safari contains a vulnerability that allows spoofing of URLs in the address bar.\r\n\r\nApple\u0027s Safari is a web browser installed as default with Mac OS X.\r\n\r\nThere is a problem in Safari where URLs displayed in the address bar could be spoofed to deceive Safari users. \r\nThis could be conducted by using Unicode characters that look alike to ASCII characters as URL strings.",
  "link": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000560.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:apple:safari",
      "@product": "Safari",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/h:apple:iphone",
      "@product": "iPhone",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2007-000560",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN16018033/index.html",
      "@id": "JVN#16018033",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3742",
      "@id": "CVE-2007-3742",
      "@source": "CVE"
    },
    {
      "#text": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3742",
      "@id": "CVE-2007-3742",
      "@source": "NVD"
    },
    {
      "#text": "http://www.securityfocus.com/bid/24636",
      "@id": "24636",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/35716",
      "@id": "35716",
      "@source": "XF"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2007/2730",
      "@id": "FrSIRT/ADV-2007-2730",
      "@source": "FRSIRT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-399",
      "@title": "Resource Management Errors(CWE-399)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-59",
      "@title": "Link Following(CWE-59)"
    }
  ],
  "title": "Safari URL spoofing vulnerability"
}

cve-2007-3742

Vulnerability from cvelistv5

Published

2007-08-03 20:00

Modified

2024-08-07 14:28

Severity ?

Summary

WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks.

References

▼	URL	Tags
	http://docs.info.apple.com/article.html?artnum=306173	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/24636	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2007/2730	vdb-entry, x_refsource_VUPEN
	http://docs.info.apple.com/article.html?artnum=306174	x_refsource_CONFIRM
	http://secunia.com/advisories/26287	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1018488	vdb-entry, x_refsource_SECTRACK
	http://www.vupen.com/english/advisories/2007/2731	vdb-entry, x_refsource_VUPEN
	https://exchange.xforce.ibmcloud.com/vulnerabilities/35716	vdb-entry, x_refsource_XF
	http://isc.sans.org/diary.html?storyid=3214	x_refsource_MISC

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:28:52.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306173"
          },
          {
            "name": "24636",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24636"
          },
          {
            "name": "ADV-2007-2730",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2730"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306174"
          },
          {
            "name": "26287",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26287"
          },
          {
            "name": "1018488",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018488"
          },
          {
            "name": "ADV-2007-2731",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2731"
          },
          {
            "name": "safari-idn-url-spoofing(35716)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35716"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://isc.sans.org/diary.html?storyid=3214"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing \"look-alike characters\" (homographs) and possibly perform phishing attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306173"
        },
        {
          "name": "24636",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24636"
        },
        {
          "name": "ADV-2007-2730",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2730"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306174"
        },
        {
          "name": "26287",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26287"
        },
        {
          "name": "1018488",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018488"
        },
        {
          "name": "ADV-2007-2731",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2731"
        },
        {
          "name": "safari-idn-url-spoofing(35716)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35716"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://isc.sans.org/diary.html?storyid=3214"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3742",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing \"look-alike characters\" (homographs) and possibly perform phishing attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306173",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306173"
            },
            {
              "name": "24636",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24636"
            },
            {
              "name": "ADV-2007-2730",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2730"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306174",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306174"
            },
            {
              "name": "26287",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26287"
            },
            {
              "name": "1018488",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018488"
            },
            {
              "name": "ADV-2007-2731",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2731"
            },
            {
              "name": "safari-idn-url-spoofing(35716)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35716"
            },
            {
              "name": "http://isc.sans.org/diary.html?storyid=3214",
              "refsource": "MISC",
              "url": "http://isc.sans.org/diary.html?storyid=3214"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3742",
    "datePublished": "2007-08-03T20:00:00",
    "dateReserved": "2007-07-12T00:00:00",
    "dateUpdated": "2024-08-07T14:28:52.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted