Mac OS X : Apple Safari < 4.0.2

High Nessus Plugin ID 39768

Synopsis

The remote host contains a web browser that is affected by several vulnerabilities.

Description

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.2 As such, it is potentially affected by two issues :

- A vulnerability in WebKit's handling of parent and top objects may allow for cross-site scripting attacks.
(CVE-2009-1724)

- A memory corruption issue in WebKit's handling of numeric character references could lead to a crash or arbitrary code execution. (CVE-2009-1725)

Solution

Upgrade to Apple Safari 4.0.2 or later.

See Also

http://support.apple.com/kb/HT3666

http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html

http://www.securityfocus.com/advisories/17297

Plugin Details

Severity: High

ID: 39768

File Name: macosx_Safari4_0_2.nasl

Version: 1.13

Type: local

Agent: macosx

Published: 2009/07/09

Updated: 2018/07/14

Dependencies: 31604

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:apple:safari

Required KB Items: Host/local_checks_enabled, Host/uname, Host/MacOSX/Version, MacOSX/Safari/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2009/07/08

Reference Information

CVE: CVE-2009-1724, CVE-2009-1725

BID: 35441, 35607

CWE: 79, 189