Vulnerability Note VU#998369
Apple Web Kit-based browsers may allow remote access to local filesystem contents
Overview
Web browsers based on AppleWebKit may allow remote web sites to reference content on the local filesystem. This may allow an attacker to execute script within the security context of the local machine.
Description
Web browsers that allow remote web sites to reference content that resides on the local filesystem may be vulnerable to cross-domain security violations. In a typical attack scenario, an attacker must first place content in a known or predictable location on a computer. If a web browser allows a remote web site to reference that content, this may allow attacker-supplied script to run within the security context of the local machine. Web browsers based on AppleWebKit, such as Safari, fail to restrict web sites from accessing content on the local filesystem. OmniWeb, which is based on Apple WebCore, also contains the same vulnerability. Current proof-of-concept exploit code uses the XMLHttpRequest object to read files from the local filesystem. |
Impact
A remote, unauthenticated attacker may be able to execute script within the security context of the local machine. Script that executes within this context may be able to perform privileged actions, such as reading files from the local filesystem. These actions would not be possible by using script that executes within the security context of the remote web site. |
Solution
Upgrade or patch |
|
Systems Affected (Learn More)
Vendor | Status | Date Notified | Date Updated |
---|---|---|---|
Apple Computer Inc. | Affected | 22 Feb 2005 | 21 Apr 2005 |
OmniGroup | Affected | 03 Mar 2005 | 06 Jul 2005 |
KDE Desktop Environment Project | Not Affected | 22 Feb 2005 | 11 May 2005 |
CVSS Metrics (Learn More)
Group | Score | Vector |
---|---|---|
Base | N/A | N/A |
Temporal | N/A | N/A |
Environmental | N/A | N/A |
References
- http://remahl.se/david/vuln/001/
- http://docs.info.apple.com/article.html?artnum=301327
- http://www.osvdb.org/15637
- http://xforce.iss.net/xforce/xfdb/20124
- http://secunia.com/advisories/14974
- http://www.securityfocus.com/bid/13202
- http://packetstormsecurity.org/0504-advisories/apple_webkit_filedisclosure.txt
- http://www.omnigroup.com/applications/omniweb/releasenotes/
Credit
Thanks to David Remahl for reporting this vulnerability.
This document was written by Will Dormann.
Other Information
- CVE IDs: CAN-2005-0976
- Date Public: 16 Apr 2005
- Date First Published: 06 Jul 2005
- Date Last Updated: 06 Jul 2005
- Severity Metric: 4.78
- Document Revision: 13
Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.