CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
Percentile
74.4%
Web browsers based on AppleWebKit may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine.
Web browsers that allow remote web sites to reference content that resides on the local filesystem may be vulnerable to cross-domain security violations. In a typical attack scenario, an attacker must first place content in a known or predictable location on a computer. If a web browser allows a remote web site to reference that content, this may allow attacker-supplied script to run within the security context of the local machine.
Web browsers based on AppleWebKit, such as Safari, fail to restrict web sites from accessing content on the local filesystem. OmniWeb, which is based on Apple WebCore, also contains the same vulnerability. Current proof-of-concept exploit code uses the XMLHttpRequest object to read files from the local filesystem.
A remote, unauthenticated attacker may be able to execute script within the security context of the local machine. Script that executes within this context may be able to perform privileged actions, such as reading files from the local filesystem. These actions would not be possible by using script that executes within the security context of the remote web site.
Upgrade or patch
Please see the Systems Affected section of this document for update availability.
Workarounds
Users who are unable to upgrade to a fixed version of the software are encouraged to disable JavaScript in their browsers.
998369
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 22, 2005 Updated: April 21, 2005
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
This vulnerability is fixed in Mac OS X 10.3.9.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23998369 Feedback>).
Notified: March 03, 2005 Updated: July 06, 2005
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
This issue is addressed in OmniWeb 5.1.1 beta 2.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23998369 Feedback>).
Notified: February 22, 2005 Updated: May 11, 2005
Not Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Konqueror does not appear to be vulnerable.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23998369 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to David Remahl for reporting this vulnerability.
This document was written by Will Dormann.
CVE IDs: | CVE-2005-0976 |
---|---|
Severity Metric: | 4.78 Date Public: |
docs.info.apple.com/article.html?artnum=301327
packetstormsecurity.org/0504-advisories/apple_webkit_filedisclosure.txt
remahl.se/david/vuln/001/
secunia.com/advisories/14974
www.omnigroup.com/applications/omniweb/releasenotes/
www.osvdb.org/15637
www.securityfocus.com/bid/13202
xforce.iss.net/xforce/xfdb/20124