CVE-2009-1712HIGH
Description
WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element.
References
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/35379
http://secunia.com/advisories/36790
http://secunia.com/advisories/37746
http://secunia.com/advisories/43068
http://securitytracker.com/id?1022345
http://support.apple.com/kb/HT3613
http://www.debian.org/security/2009/dsa-1950
http://www.securityfocus.com/bid/35260
http://www.securityfocus.com/bid/35350
http://www.ubuntu.com/usn/USN-836-1
http://www.ubuntu.com/usn/USN-857-1
http://www.vupen.com/english/advisories/2009/1522
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:apple:safari:0.8:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:0.9:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.0:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.0.3:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.1:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.2:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.3:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.3.1:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:1.3.2:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:2.0:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:2.0.2:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:2.0.4:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.3:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.4:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1.1:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1.2:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.2.1:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:3.2.3:*:mac:*:*:*:*:*
cpe:2.3:a:apple:safari:*:*:mac:*:*:*:*:* versions up to 4.0_beta (inclusive)
Configuration 2
OR
cpe:2.3:a:apple:safari:3.0:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.2:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.3:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.0.4:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1.1:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.1.2:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.2.1:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:3.2.2:*:windows:*:*:*:*:*
cpe:2.3:a:apple:safari:*:*:windows:*:*:*:*:* versions up to 3.2.3 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 75629 | openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1) | Nessus | SuSE Local Security Checks | critical |
| 53764 | openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1) | Nessus | SuSE Local Security Checks | critical |
| 44852 | Debian DSA-1988-1 : qt4-x11 - several vulnerabilities | Nessus | Debian Local Security Checks | high |
| 44815 | Debian DSA-1950-1 : webkit - several vulnerabilities | Nessus | Debian Local Security Checks | high |
| 42467 | Ubuntu 8.10 / 9.04 : qt4-x11 vulnerabilities (USN-857-1) | Nessus | Ubuntu Local Security Checks | high |
| 41606 | Ubuntu 8.10 / 9.04 : webkit vulnerabilities (USN-836-1) | Nessus | Ubuntu Local Security Checks | high |
| 39339 | Safari < 4.0 Multiple Vulnerabilities | Nessus | Windows | high |
| 39338 | Mac OS X : Apple Safari < 4.0 | Nessus | MacOS X Local Security Checks | high |
| 5046 | Safari < 4.0 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | high |
| 800993 | Safari < 4.0 Multiple Vulnerabilities | Log Correlation Engine | Web Clients | high |