{"type": "osvdb", "published": "2004-12-02T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:12206", "bulletinFamily": "software", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 7.5}, "viewCount": 0, "edition": 1, "reporter": "Jakob Balle(jb@secunia.com)", "title": "Apple Safari Spoof Pop-Up Windows", "affectedSoftware": [{"operator": "eq", "version": "10.3.1", "name": "Mac OS X"}, {"operator": "eq", "version": "1.2.3", "name": "Safari"}, {"operator": "eq", "version": "10.3.6", "name": "Mac OS X"}, {"operator": "eq", "version": "10.2.x", "name": "Mac OS X"}, {"operator": "eq", "version": "10.3.3", "name": "Mac OS X"}, {"operator": "eq", "version": "10.3.5", "name": "Mac OS X"}, {"operator": "eq", "version": "10.3", "name": "Mac OS X"}, {"operator": "eq", "version": "10.3.2", "name": "Mac OS X"}, {"operator": "eq", "version": "10.3.4", "name": "Mac OS X"}], "enchantments": {"score": {"value": 4.1, "vector": "NONE", "modified": "2017-04-28T13:20:07", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2004-1122"]}, {"type": "nessus", "idList": ["MACOSX_SECUPD20041202.NASL"]}], "modified": "2017-04-28T13:20:07", "rev": 2}, "vulnersScore": 4.1}, "references": [], "id": "OSVDB:12206", "lastseen": "2017-04-28T13:20:07", "cvelist": ["CVE-2004-1122"], "modified": "2004-12-02T00:00:00", "description": "## Vulnerability Description\nMac OS X contains a flaw that may allow a malicious user to spoof dialog boxes from inactive browser windows. The issue is triggered a user is sent a malicious URL, which then launches a window which appears to be initiated by the web site in the active window. It is possible that the flaw may allow users to be tricked into revealing sensitive information resulting in a loss of confidentiality.\n## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch to address this vulnerability.\n## Short Description\nMac OS X contains a flaw that may allow a malicious user to spoof dialog boxes from inactive browser windows. The issue is triggered a user is sent a malicious URL, which then launches a window which appears to be initiated by the web site in the active window. It is possible that the flaw may allow users to be tricked into revealing sensitive information resulting in a loss of confidentiality.\n## References:\n[Vendor Specific Advisory URL](http://docs.info.apple.com/article.html?artnum=61798)\n[Secunia Advisory ID:13362](https://secuniaresearch.flexerasoftware.com/advisories/13362/)\n[Secunia Advisory ID:12892](https://secuniaresearch.flexerasoftware.com/advisories/12892/)\n[CVE-2004-1122](https://vulners.com/cve/CVE-2004-1122)\n"}

{"cve": [{"lastseen": "2020-10-03T11:33:40", "description": "Safari 1.x to 1.2.4, and possibly other versions, allows inactive windows to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows, aka the \"Dialog Box Spoofing Vulnerability,\" a different vulnerability than CVE-2004-1314.", "edition": 3, "cvss3": {}, "published": "2005-01-10T05:00:00", "title": "CVE-2004-1122", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2004-1122"], "modified": "2008-09-10T19:29:00", "cpe": ["cpe:/a:apple:safari:1.2.3"], "id": "CVE-2004-1122", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1122", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apple:safari:1.2.3:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-01T03:25:05", "description": "The remote host is missing Security Update 2004-12-02. This security\nupdate contains a number of fixes for the following programs :\n\n - Apache\n - Apache2\n - AppKit\n - Cyrus IMAP\n - HIToolbox\n - Kerberos\n - Postfix\n - PSNormalizer\n - QuickTime Streaming Server\n - Safari\n - Terminal\n\nThese programs contain multiple vulnerabilities that could allow a\nremote attacker to execute arbitrary code.", "edition": 23, "published": "2004-12-02T00:00:00", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-1121", "CVE-2004-0644", "CVE-2004-1123", "CVE-2004-0786", "CVE-2004-0747", "CVE-2003-0987", "CVE-2004-0643", "CVE-2004-0885", "CVE-2004-1122", "CVE-2004-0804", "CVE-2004-1086", "CVE-2004-0642", "CVE-2004-0748", "CVE-2004-1088", "CVE-2004-1087", "CVE-2004-0803", "CVE-2004-1084", "CVE-2004-1081", "CVE-2004-0940", "CVE-2004-1082", "CVE-2004-0772", "CVE-2004-0174", "CVE-2004-1089", "CVE-2004-0488", "CVE-2004-1083", "CVE-2004-0492", "CVE-2003-0020", "CVE-2004-1085", "CVE-2004-0886", "CVE-2004-0751"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:apple:mac_os_x"], "id": "MACOSX_SECUPD20041202.NASL", "href": "https://www.tenable.com/plugins/nessus/15898", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\nif (NASL_LEVEL < 3004) exit(0); # a large number of xrefs.\nif ( ! defined_func(\"bn_random\") ) exit(0);\n\ninclude(\"compat.inc\");\n\nif(description)\n{\n script_id(15898);\n script_version (\"1.24\");\n script_cvs_date(\"Date: 2018/07/14 1:59:35\");\n\n script_cve_id(\"CVE-2004-1082\", \"CVE-2003-0020\", \"CVE-2003-0987\", \"CVE-2004-0174\", \"CVE-2004-0488\", \n \"CVE-2004-0492\", \"CVE-2004-0885\", \"CVE-2004-0940\", \"CVE-2004-1083\", \"CVE-2004-1084\", \n \"CVE-2004-0747\", \"CVE-2004-0786\", \"CVE-2004-0751\", \"CVE-2004-0748\", \"CVE-2004-1081\", \n \"CVE-2004-0803\", \"CVE-2004-0804\", \"CVE-2004-0886\", \"CVE-2004-1089\", \"CVE-2004-1085\", \n \"CVE-2004-0642\", \"CVE-2004-0643\", \"CVE-2004-0644\", \"CVE-2004-0772\", \"CVE-2004-1088\", \n \"CVE-2004-1086\", \"CVE-2004-1123\", \"CVE-2004-1121\", \"CVE-2004-1122\", \"CVE-2004-1087\");\n script_bugtraq_id(9921, 9930, 9571, 11471, 11360, 11469, 10508, 11802);\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)\");\n script_summary(english:\"Check for Security Update 2004-12-02\");\n \n script_set_attribute( attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes a security\nissue.\" );\n script_set_attribute( attribute:\"description\", value:\n\"The remote host is missing Security Update 2004-12-02. This security\nupdate contains a number of fixes for the following programs :\n\n - Apache\n - Apache2\n - AppKit\n - Cyrus IMAP\n - HIToolbox\n - Kerberos\n - Postfix\n - PSNormalizer\n - QuickTime Streaming Server\n - Safari\n - Terminal\n\nThese programs contain multiple vulnerabilities that could allow a\nremote attacker to execute arbitrary code.\" );\n # http://web.archive.org/web/20080915104713/http://support.apple.com/kb/HT1646?\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?210abeb5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Install Security Update 2004-12-02.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119);\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2004/12/02\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2003/02/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2004/12/02\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/MacOSX/packages\");\n exit(0);\n}\n\n\npackages = get_kb_item(\"Host/MacOSX/packages\");\nif ( ! packages ) exit(0);\n\nuname = get_kb_item(\"Host/uname\");\n# MacOS X 10.2.8, 10.3.6 only\nif ( egrep(pattern:\"Darwin.* (6\\.8\\.|7\\.6\\.)\", string:uname) )\n{\n if ( ! egrep(pattern:\"^SecUpd(Srvr)?2004-12-02\", string:packages) ) security_hole(0);\n\telse non_vuln = 1;\n}\nelse if ( egrep(pattern:\"Darwin.* (6\\.9|[0-9][0-9]\\.|7\\.([7-9]|[0-9][0-9]\\.|[8-9]\\.))\", string:uname) ) non_vuln = 1;\n\nif ( non_vuln )\n{\n set_kb_item(name:\"CVE-2004-1082\", value:TRUE);\n set_kb_item(name:\"CVE-2003-0020\", value:TRUE);\n set_kb_item(name:\"CVE-2003-0987\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0174\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0488\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0492\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0885\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0940\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1083\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1084\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0747\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0786\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0751\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0748\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1081\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0803\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0804\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0886\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1089\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1085\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0642\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0643\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0644\", value:TRUE);\n set_kb_item(name:\"CVE-2004-0772\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1088\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1086\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1123\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1121\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1122\", value:TRUE);\n set_kb_item(name:\"CVE-2004-1087\", value:TRUE);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}