[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
iDefense Security Advisory 10.12.11: Apple MobileSafari Attachment Viewing Cross Site Scripting Vulnerability
iDefense Security Advisory 10.12.11
Oct 12, 2011
MobileSafari is Apple's mobile we browser for iOS devices. For more
information about MobileSafari, please the visit following website:
Remote exploitation of a cross site scripting vulnerability in Apple
Inc.'s MobileSafari could allow an attacker to view sensitive
information in the context of the targeted domain.
This vulnerability occurs in MobileSafari's handling of the
Content-Disposition header, which is typically used to inform the
browser that an attachment is contained in the current response. Typical
browser behavior is to prompt the user with an Open dialog, asking them
how they would like to handle the attachment content (such as opening an
external program). However, MobileSafari does not prompt the user, and
instead opens the attached content in the browser. If an attacker can
persuade a target to open an HTML attachment (such as by attaching an
HTML file to an email), then this file will open in the context of the
domain serving the file. This allows the HTML attachment full access to
the DOM of the targeted domain, which can allow for cross site
Exploitation of this vulnerability results in the disclosure of
potentially sensitive information, such as document cookies, on the
target domain. To exploit this vulnerability, a targeted user must open
an attachment from an affected domain. An attacker typically
accomplishes this via social engineering or injecting content into
compromised, trusted sites. Note that a user has to open an attachment,
which takes at least one click; however, MobileSafari does not display
an "Open" prompt dialog, so nothing beyond the initial click is
iOS versions prior to 5 are vulnerable.
iDefense is currently unaware of any workarounds for this issue.
VI. VENDOR RESPONSE
Apple has released a fix which addresses this issue. Information about
downloadable vendor updates can be found by clicking on the URLs shown.
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2011-3426 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
VIII. DISCLOSURE TIMELINE
03/02/2011 Initial Vendor Notification
03/02/2011 Vendor Reply
10/12/2011 Coordinated Public Disclosure
This vulnerability was reported to iDefense by Christian Matthies.
Get paid for vulnerability research
Free tools, research and upcoming events
X. LEGAL NOTICES
Copyright Â© 2011 Verisign
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
e-mail customerservice@xxxxxxxxxxxx for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,