A security flaw was found in the WebKit's Cross-Origin Resource Sharing (CORS) implementation. Multiple security flaws (integer underflow, invalid pointer dereference, buffer underflow and a denial of service) were found in the way WebKit's FTP parser used to process remote FTP directory listings.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Safari installed on the remote Windows host is earlier than 4.0.4.  Such versions are potentially affected by several issues :

  - An integer overflow in the handling of images with an     embedded color profile could lead to a crash or     arbitrary code execution. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the     most serious of which could lead to a program crash.
    (CVE-2009-2414, CVE-2009-2416)

  - An issue in the handling of navigations initiated via     the 'Open Image in New Tab', 'Open Image in New Window'     or 'Open Link in New Tab' shortcut menu options could     be exploited to load a local HTML file, leading to     disclosure of sensitive information. (CVE-2009-2842)

  - An issue involving WebKit's inclusion of custom HTTP     headers specified by a requesting page in preflight     requests in support of Cross-Origin Resource Sharing     can facilitate cross-site request forgery attacks.     (CVE-2009-2816)

  - Multiple issues in WebKit's handling of FTP directory     listings may lead to information disclosure, unexpected     application termination, or execution of arbitrary     code. (CVE-2009-3384)

The version of Google Chrome installed on the remote host is earlier than 3.0.195.33.  Such versions are reportedly affected by a security bypass vulnerability caused by cusom headers being incorrectly sent for 'CORS OPTIONS' requests.  A malicious website operator could set custom HTTP headers on cross-origin 'OPTIONS' requests.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.4.  As such, it is potentially affected by several issues :

  - Multiple use-after-free issues exist in libxml2, the     most serious of which could lead to a program crash.
    (CVE-2009-2414, CVE-2009-2416)

  - An issue in the handling of navigations initiated via     the 'Open Image in New Tab', 'Open Image in New Window'     or 'Open Link in New Tab' shortcut menu options could     be exploited to load a local HTML file, leading to     disclosure of sensitive information. (CVE-2009-2842)

  - An issue involving WebKit's inclusion of custom HTTP     headers specified by a requesting page in preflight     requests in support of Cross-Origin Resource Sharing     can facilitate cross-site request forgery attacks.     (CVE-2009-2816)

  - WebKit fails to issue a resource load callback to     determine if a resource should be loaded when it     encounters an HTML 5 Media Element pointing to an     external resource, which could lead to undesired     requests to remote servers. (CVE-2009-2841)

The version of Google Chrome installed on the remote host is earlier than 3.0.195.33.  Such versions are potentially affected by a security bypass vulnerability caused by custom headers being incorrectly sent for 'CORS OPTIONS' requests.  A malicious web site operator could set custom HTTP headers on cross-origin 'OPTIONS' requests.

The version of Safari installed on the remote host is earlier than 4.0.4.  Such versions are potentially affected by multiple issues : 

  - An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. (CVE-2009-2414, CVE-2009-2416)

  - An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)

  - An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which could lead to cross-site request forger attacks. (CVE-2009-2816)

  - Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. (CVE-2009-3384)

  - When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. (CVE-2009-2841)

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

The version of Safari installed on the remote host is earlier than 4.0.4.  Such versions are potentially affected by multiple issues : 

  - An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. (CVE-2009-2414, CVE-2009-2416)

  - An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)

  - An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which could lead to cross-site request forger attacks. (CVE-2009-2816)

  - Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. (CVE-2009-3384)

  - When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. (CVE-2009-2841)

IAVT Reference : 2009-T-0049
STIG Finding Severity : Category I

ID	Name	Product	Family	Published	Updated	Severity
42804	Fedora 10 : qt-4.5.3-9.fc10 (2009-11488)	Nessus	Fedora Local Security Checks	11/16/2009	1/11/2021	high
42478	Safari < 4.0.4 Multiple Vulnerabilities	Nessus	Windows	11/12/2009	7/27/2018	high
42798	Google Chrome < 3.0.195.33 Multiple Vulnerabilities	Nessus	Windows	11/13/2009	4/11/2022	medium
42803	Fedora 12 : qt-4.5.3-9.fc12 (2009-11487)	Nessus	Fedora Local Security Checks	11/16/2009	1/11/2021	high
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
42807	Fedora 11 : qt-4.5.3-9.fc11 (2009-11491)	Nessus	Fedora Local Security Checks	11/16/2009	1/11/2021	high
42477	Mac OS X : Apple Safari < 4.0.4	Nessus	MacOS X Local Security Checks	11/12/2009	7/14/2018	high
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	critical
5234	Google Chrome < 3.0.195.33 Security Bypass Vulnerability.	Nessus Network Monitor	Web Clients	11/13/2009	3/6/2019	medium
5232	Safari < 4.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	11/11/2009	3/6/2019	medium
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	6/22/2010	3/6/2019	critical
801003	Safari < 4.0.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	11/11/2009		high

Detections

Analytics

Plugins Search

high

high

medium

high

critical

high

high

critical

medium

medium

critical

high