var-201110-0288
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header. Yoshinori Ohta of Business Architects Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Opening a maliciously crafted file may lead to an arbitrary script being executed on the user's web browser. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. NOTE: This issue was previously discussed in BID 50086 (Apple iPhone/iPad/iPod touch Prior to iOS 5 Multiple Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Ovum says ad hoc tools are out-dated. The best practice approach? Fast vulnerability intelligence, threat handling, and setup in one tool.
Read the new report on the Secunia VIM: http://secunia.com/products/corporate/vim/ovum_2011_request/
TITLE: Apple iOS Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA46377
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46377/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46377
RELEASE DATE: 2011-10-14
DISCUSS ADVISORY: http://secunia.com/advisories/46377/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/46377/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=46377
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in Apple iOS, which can be exploited by malicious people with physical access to disclose certain information and by malicious people to conduct script insertion, cross-site scripting, and spoofing attacks, disclose sensitive information, bypass certain security restrictions, cause a DoS (Denial of Service), and compromise a user's device.
1) An error within the CalDAV component does not properly validate the SSL certificate when synchronizing the calendar, which can be exploited to disclose encrypted information e.g. using a Man-in-the-Middle (MitM) attack.
2) Input passed via invitation notes is not properly sanitised in Calendar before being returned to the user.
3) The CFNetwork component stores a user's AppleID password and username in the log file readable by applications, which can be exploited to disclose the credentials.
4) The CFNetwork component does not properly restrict cross-domain access of HTTP cookies, which can be exploited to access the cookies of another web site.
5) An error exists within CoreFoundation when handling string tokenization.
For more information see vulnerability #1 in: SA46339
6) Multiple errors within CoreGraphics when handling the certain freetype fonts can be exploited to corrupt memory.
7) An error within CoreMedia does not properly handle cross-site redirects and can be exploited to disclose video data.
8) An error exits within the Data Access component when handling multiple accounts configured on the same server and can be exploited to disclose the cookie of another account.
9) The application accepts X.509 certificates with MD5 hashes, which could lead to weak cryptographic certificates being used. This can be exploited to disclose encrypted information e.g. using a Man-in-the-Middle (MitM) attack.
10) A design error exists within the implementation of SSL 3.0 and TLS 1.0 protocols.
For more information: SA46168
11) An error within ImageIO when handling CCITT Group 4 encoded TIFF files can be exploited to cause a buffer overflow.
For more information see vulnerability #1 in: SA43593
12) An error in ImageIO within the handling of CCITT Group 4 encoded TIFF image files can be exploited to cause a heap-based buffer overflow.
For more information see vulnerability #9 in: SA45325
13) An error within ICU (International Components for Unicode) can be exploited to cause a buffer overflow.
For more information see vulnerability #11 in: SA45054
14) An error within the kernel does not reclaim memory from incomplete TCP connections, which can be exploited to exhaust system resources by connecting to a listening service and cause the device to reset.
15) A NULL-pointer dereference error within the kernel when handling IPv6 socket options can be exploited to cause the device to reset.
16) An error within libxml can be exploited to cause a heap-based buffer overflow.
For more information see vulnerability #12 in: SA45325
17) An error within OfficeImport when viewing certain Microsoft Word files can be exploited to cause a buffer overflow.
18) An error within OfficeImport when viewing certain Microsoft Excel files can be exploited to cause a buffer overflow.
19) An indexing error exists in the OfficeImport framework when processing certain records in a Microsoft Word file.
For more information see vulnerability #19 in: SA45054
20) An error in the OfficeImport framework when processing records can be exploited to corrupt memory.
22) The parental restrictions feature stores the restrictions passcode in plaintext on disk and can be exploited to disclose the passcode.
23) An error within UIKit does not properly handle "tel:" URIs and can be exploited to cause the device to hang by tricking the user into visiting a malicious website.
24) Some vulnerabilities are caused due to a bundled vulnerable version of WebKit.
For more information: SA43519 SA43683 SA43696 SA43859 SA45097 SA45325 SA45325 SA45498 SA45498 SA46339 SA46412
25) The WiFi credentials are stored in a file readable by other applications, which may lead to the credentials being disclosed.
Successful exploitation of vulnerabilities #6, #16 \x96 #20, and #24 may allow execution of arbitrary code.
SOLUTION: Apply iOS 5 Software Update.
PROVIDED AND/OR DISCOVERED BY: 1) Leszek Tasiemski, nSense. 6, 9) Reported by the vendor.
The vendor credits: 2) Rick Deacon 3) Peter Quade, qdevelop 4) Erling Ellingsen, Facebook. 7) Nirankush Panchbhai and Microsoft Vulnerability Research (MSVR) 8) Bob Sielken, IBM 14) Wouter van der Veer, Topicus and Josh Enders 15) Thomas Clement, Intego 17) Tobias Klein via iDefense. 22) An anonymous person 23) Simon Young, Anglia Ruskin University 25) Laurent OUDOT, TEHTRI Security
ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4999
nSense: http://www.nsense.fi/advisories/nsense_2011_006.txt
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. BACKGROUND
MobileSafari is Apple's mobile we browser for iOS devices. For more information about MobileSafari, please the visit following website:
http://www.apple.com/iphone/built-in-apps/safari.html
II. DESCRIPTION
Remote exploitation of a cross site scripting vulnerability in Apple Inc.'s MobileSafari could allow an attacker to view sensitive information in the context of the targeted domain.
This vulnerability occurs in MobileSafari's handling of the Content-Disposition header, which is typically used to inform the browser that an attachment is contained in the current response. Typical browser behavior is to prompt the user with an Open dialog, asking them how they would like to handle the attachment content (such as opening an external program). However, MobileSafari does not prompt the user, and instead opens the attached content in the browser. If an attacker can persuade a target to open an HTML attachment (such as by attaching an HTML file to an email), then this file will open in the context of the domain serving the file. This allows the HTML attachment full access to the DOM of the targeted domain, which can allow for cross site scripting.
III. ANALYSIS
Exploitation of this vulnerability results in the disclosure of potentially sensitive information, such as document cookies, on the target domain. To exploit this vulnerability, a targeted user must open an attachment from an affected domain. An attacker typically accomplishes this via social engineering or injecting content into compromised, trusted sites. Note that a user has to open an attachment, which takes at least one click; however, MobileSafari does not display an "Open" prompt dialog, so nothing beyond the initial click is necessary.
IV. DETECTION
iOS versions prior to 5 are vulnerable.
V. WORKAROUND
iDefense is currently unaware of any workarounds for this issue.
VI. VENDOR RESPONSE
Apple has released a fix which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.
http://lists.apple.com/archives/Security-announce/2011/Oct/msg00001.html
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-3426 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
03/02/2011 Initial Vendor Notification 03/02/2011 Vendor Reply 10/12/2011 Coordinated Public Disclosure
IX.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright © 2011 Verisign
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201110-0288",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.3.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "for ios"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1-"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0-"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "iphone ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1-"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2-"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3-"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2-"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1-"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1-"
},
{
"model": "iphone ipodtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0-"
},
{
"model": "iphone iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0-"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "5"
}
],
"sources": [
{
"db": "BID",
"id": "50124"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.1:-:ipodtouch:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.5:-:ipodtouch:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.5:-:ipad:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.2.1:-:ipad:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.0:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.2:-:ipodtouch:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.2:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.1.2:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.1:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:3.1.3:-:iphone:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-3426"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Christian Matthies",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
],
"trust": 0.6
},
"cve": "CVE-2011-3426",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2011-000088",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-51371",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-3426",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2011-000088",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-201110-337",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-51371",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a \"Content-Disposition: attachment\" HTTP header. Yoshinori Ohta of Business Architects Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Opening a maliciously crafted file may lead to an arbitrary script being executed on the user\u0027s web browser. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. \nNOTE: This issue was previously discussed in BID 50086 (Apple iPhone/iPad/iPod touch Prior to iOS 5 Multiple Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\nOvum says ad hoc tools are out-dated. The best practice approach?\nFast vulnerability intelligence, threat handling, and setup in one tool. \n\nRead the new report on the Secunia VIM:\nhttp://secunia.com/products/corporate/vim/ovum_2011_request/ \n\n----------------------------------------------------------------------\n\nTITLE:\nApple iOS Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA46377\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/46377/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46377\n\nRELEASE DATE:\n2011-10-14\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/46377/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/46377/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46377\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in Apple iOS, which can\nbe exploited by malicious people with physical access to disclose\ncertain information and by malicious people to conduct script\ninsertion, cross-site scripting, and spoofing attacks, disclose\nsensitive information, bypass certain security restrictions, cause a\nDoS (Denial of Service), and compromise a user\u0027s device. \n\n1) An error within the CalDAV component does not properly validate\nthe SSL certificate when synchronizing the calendar, which can be\nexploited to disclose encrypted information e.g. using a\nMan-in-the-Middle (MitM) attack. \n\n2) Input passed via invitation notes is not properly sanitised in\nCalendar before being returned to the user. \n\n3) The CFNetwork component stores a user\u0027s AppleID password and\nusername in the log file readable by applications, which can be\nexploited to disclose the credentials. \n\n4) The CFNetwork component does not properly restrict cross-domain\naccess of HTTP cookies, which can be exploited to access the cookies\nof another web site. \n\n5) An error exists within CoreFoundation when handling string\ntokenization. \n\nFor more information see vulnerability #1 in:\nSA46339\n\n6) Multiple errors within CoreGraphics when handling the certain\nfreetype fonts can be exploited to corrupt memory. \n\n7) An error within CoreMedia does not properly handle cross-site\nredirects and can be exploited to disclose video data. \n\n8) An error exits within the Data Access component when handling\nmultiple accounts configured on the same server and can be exploited\nto disclose the cookie of another account. \n\n9) The application accepts X.509 certificates with MD5 hashes, which\ncould lead to weak cryptographic certificates being used. This can be\nexploited to disclose encrypted information e.g. using a\nMan-in-the-Middle (MitM) attack. \n\n10) A design error exists within the implementation of SSL 3.0 and\nTLS 1.0 protocols. \n\nFor more information:\nSA46168\n\n11) An error within ImageIO when handling CCITT Group 4 encoded TIFF\nfiles can be exploited to cause a buffer overflow. \n\nFor more information see vulnerability #1 in:\nSA43593\n\n12) An error in ImageIO within the handling of CCITT Group 4 encoded\nTIFF image files can be exploited to cause a heap-based buffer\noverflow. \n\nFor more information see vulnerability #9 in:\nSA45325\n\n13) An error within ICU (International Components for Unicode) can be\nexploited to cause a buffer overflow. \n\nFor more information see vulnerability #11 in:\nSA45054\n\n14) An error within the kernel does not reclaim memory from\nincomplete TCP connections, which can be exploited to exhaust system\nresources by connecting to a listening service and cause the device\nto reset. \n\n15) A NULL-pointer dereference error within the kernel when handling\nIPv6 socket options can be exploited to cause the device to reset. \n\n16) An error within libxml can be exploited to cause a heap-based\nbuffer overflow. \n\nFor more information see vulnerability #12 in:\nSA45325\n\n17) An error within OfficeImport when viewing certain Microsoft Word\nfiles can be exploited to cause a buffer overflow. \n\n18) An error within OfficeImport when viewing certain Microsoft Excel\nfiles can be exploited to cause a buffer overflow. \n\n19) An indexing error exists in the OfficeImport framework when\nprocessing certain records in a Microsoft Word file. \n\nFor more information see vulnerability #19 in:\nSA45054\n\n20) An error in the OfficeImport framework when processing records\ncan be exploited to corrupt memory. \n\n22) The parental restrictions feature stores the restrictions\npasscode in plaintext on disk and can be exploited to disclose the\npasscode. \n\n23) An error within UIKit does not properly handle \"tel:\" URIs and\ncan be exploited to cause the device to hang by tricking the user\ninto visiting a malicious website. \n\n24) Some vulnerabilities are caused due to a bundled vulnerable\nversion of WebKit. \n\nFor more information:\nSA43519\nSA43683\nSA43696\nSA43859\nSA45097\nSA45325\nSA45325\nSA45498\nSA45498\nSA46339\nSA46412\n\n25) The WiFi credentials are stored in a file readable by other\napplications, which may lead to the credentials being disclosed. \n\nSuccessful exploitation of vulnerabilities #6, #16 \\x96 #20, and #24 may\nallow execution of arbitrary code. \n\nSOLUTION:\nApply iOS 5 Software Update. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) Leszek Tasiemski, nSense. \n6, 9) Reported by the vendor. \n\nThe vendor credits:\n2) Rick Deacon\n3) Peter Quade, qdevelop\n4) Erling Ellingsen, Facebook. \n7) Nirankush Panchbhai and Microsoft Vulnerability Research (MSVR)\n8) Bob Sielken, IBM\n14) Wouter van der Veer, Topicus and Josh Enders\n15) Thomas Clement, Intego\n17) Tobias Klein via iDefense. \n22) An anonymous person\n23) Simon Young, Anglia Ruskin University\n25) Laurent OUDOT, TEHTRI Security\n\nORIGINAL ADVISORY:\nApple:\nhttp://support.apple.com/kb/HT4999\n\nnSense:\nhttp://www.nsense.fi/advisories/nsense_2011_006.txt\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. BACKGROUND\n\nMobileSafari is Apple\u0027s mobile we browser for iOS devices. For more\ninformation about MobileSafari, please the visit following website:\n\nhttp://www.apple.com/iphone/built-in-apps/safari.html\n\nII. DESCRIPTION\n\nRemote exploitation of a cross site scripting vulnerability in Apple\nInc.\u0027s MobileSafari could allow an attacker to view sensitive\ninformation in the context of the targeted domain. \n\nThis vulnerability occurs in MobileSafari\u0027s handling of the\nContent-Disposition header, which is typically used to inform the\nbrowser that an attachment is contained in the current response. Typical\nbrowser behavior is to prompt the user with an Open dialog, asking them\nhow they would like to handle the attachment content (such as opening an\nexternal program). However, MobileSafari does not prompt the user, and\ninstead opens the attached content in the browser. If an attacker can\npersuade a target to open an HTML attachment (such as by attaching an\nHTML file to an email), then this file will open in the context of the\ndomain serving the file. This allows the HTML attachment full access to\nthe DOM of the targeted domain, which can allow for cross site\nscripting. \n\nIII. ANALYSIS\n\nExploitation of this vulnerability results in the disclosure of\npotentially sensitive information, such as document cookies, on the\ntarget domain. To exploit this vulnerability, a targeted user must open\nan attachment from an affected domain. An attacker typically\naccomplishes this via social engineering or injecting content into\ncompromised, trusted sites. Note that a user has to open an attachment,\nwhich takes at least one click; however, MobileSafari does not display\nan \"Open\" prompt dialog, so nothing beyond the initial click is\nnecessary. \n\nIV. DETECTION\n\niOS versions prior to 5 are vulnerable. \n\nV. WORKAROUND\n\niDefense is currently unaware of any workarounds for this issue. \n\nVI. VENDOR RESPONSE\n\nApple has released a fix which addresses this issue. Information about\ndownloadable vendor updates can be found by clicking on the URLs shown. \n\nhttp://lists.apple.com/archives/Security-announce/2011/Oct/msg00001.html\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2011-3426 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n03/02/2011 Initial Vendor Notification\n03/02/2011 Vendor Reply\n10/12/2011 Coordinated Public Disclosure\n\nIX. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \u00a9 2011 Verisign\n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically, please\ne-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct, indirect,\nor consequential loss or damage arising from use of, or reliance on,\nthis information",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "BID",
"id": "50124"
},
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "PACKETSTORM",
"id": "105765"
},
{
"db": "PACKETSTORM",
"id": "105793"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-51371",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-3426",
"trust": 2.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVN41657660",
"trust": 1.9
},
{
"db": "OSVDB",
"id": "76334",
"trust": 1.1
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "46377",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "17917",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2011-10-12-1",
"trust": 0.6
},
{
"db": "BID",
"id": "50124",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "105793",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-51371",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "105765",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "BID",
"id": "50124"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "PACKETSTORM",
"id": "105765"
},
{
"db": "PACKETSTORM",
"id": "105793"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"id": "VAR-201110-0288",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:38:53.305000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "About the security content of iOS 5 Software Update",
"trust": 0.8,
"url": "https://support.apple.com/kb/ht4999"
},
{
"title": "About the security content of Safari 6",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht5400"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://jvn.jp/en/jp/jvn41657660/index.html"
},
{
"trust": 1.8,
"url": "http://support.apple.com/kb/ht4999"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2011//oct/msg00001.html"
},
{
"trust": 1.1,
"url": "http://lists.apple.com/archives/security-announce/2012/jul/msg00000.html"
},
{
"trust": 1.1,
"url": "http://support.apple.com/kb/ht5400"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2014/jul/158"
},
{
"trust": 1.1,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2011-000088"
},
{
"trust": 1.1,
"url": "http://osvdb.org/76334"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70558"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3426"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3426"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/46377"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/17917"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=950"
},
{
"trust": 0.3,
"url": "http://www.apple.com/iphone/softwareupdate/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipad/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/iphone/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipodtouch/"
},
{
"trust": 0.1,
"url": "https://www.trapkit.de"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/46377/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://www.nsense.fi/advisories/nsense_2011_006.txt"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/vim/ovum_2011_request/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46377"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/46377/"
},
{
"trust": 0.1,
"url": "http://lists.apple.com/archives/security-announce/2011/oct/msg00001.html"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3426"
},
{
"trust": 0.1,
"url": "http://www.apple.com/iphone/built-in-apps/safari.html"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "BID",
"id": "50124"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "PACKETSTORM",
"id": "105765"
},
{
"db": "PACKETSTORM",
"id": "105793"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-51371"
},
{
"db": "BID",
"id": "50124"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"db": "PACKETSTORM",
"id": "105765"
},
{
"db": "PACKETSTORM",
"id": "105793"
},
{
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-14T00:00:00",
"db": "VULHUB",
"id": "VHN-51371"
},
{
"date": "2011-10-12T00:00:00",
"db": "BID",
"id": "50124"
},
{
"date": "2011-10-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"date": "2011-10-13T09:15:38",
"db": "PACKETSTORM",
"id": "105765"
},
{
"date": "2011-10-14T05:54:04",
"db": "PACKETSTORM",
"id": "105793"
},
{
"date": "2011-10-14T10:55:10.590000",
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"date": "2011-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-51371"
},
{
"date": "2015-03-19T08:42:00",
"db": "BID",
"id": "50124"
},
{
"date": "2012-08-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-000088"
},
{
"date": "2017-08-29T01:30:11.863000",
"db": "NVD",
"id": "CVE-2011-3426"
},
{
"date": "2011-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "105793"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Safari for iOS vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-000088"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "105793"
},
{
"db": "CNNVD",
"id": "CNNVD-201110-337"
}
],
"trust": 0.7
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.