CVE-2010-1834

The CVE-2010-1834 issue affects Apple Mac OS X 10.6.x prior to 10.6.5 where CFNetwork does not properly validate cookie domains, allowing a cookie set for a partial IP address to be sent to third-party sites. Root cause: an implementation flaw in CFNetwork’s handling of domain specifications in c...

CVE-2010-1834: Improper Input Validation

CFNetwork in Apple Mac OS X 10.6.x before 10.6.5 does not properly validate the domains of cookies, which makes it easier for remote web servers to track users by setting a cookie that is associated with a partial IP address...

Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities. Mac OS X 10.6.5 contains security fixes for the following products : - AFP Server - Apache modperl - Apache - AppKit - ATS - CFNetwork - CoreGraphics - CoreText - CUPS - Directory Services -...

Mac OS X Multiple Vulnerabilities (Security Update 2010-007)

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. This security update contains fixes for the following products : - AFP Server - Apache modperl - ATS - CFNetwork - CoreGraphics - CoreText - CUPS - Directory Services - diskdevcmds - Disk...

CVE-2010-1800

CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses...

Design/Logic Flaw

CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses...

CVE-2010-1800

CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses...

CVE-2010-1800

CVE-2010-1800 affects CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4. It allows man-in-the-middle attackers to redirect connections and obtain sensitive information via crafted SSL/TLS responses due to support for anonymous connections. The root cause is the handling of anonymous SSL/TLS in CFNetw...

Apple Fixes 13 Bugs in Major OS X Patch Release

Apple released a patch Tuesday that fixes more than a dozen bugs, including a critical remote code-execution flaw in Apple Type Services. The patch release also includes a fix for a flaw in CFNetwork that enabled an attacker to intercept user credentials and other sensitive data silently on a...

Apple Releases Security Update 2010-005

Apple has released security update 2010-005 to address multiple vulnerabilities affecting the ATS, CFNetwork, ClamAV, CoreGraphics, libsecurity, PHP, and Samba applications. These vulnerabilities may allow an attacker to execute arbitrary code, obtain sensitive information, cause a...

CVE-2010-1800: Exposure of Sensitive Information to an Unauthorized Actor

CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses...

Mac OS X Multiple Vulnerabilities (Security Update 2010-005)

The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2010-005 applied. This security update contains fixes for the following products : - ATS - CFNetwork - ClamAV - CoreGraphics - libsecurity - PHP - Samba C Tenable Network Security, Inc. if...

Security Advisories from TEHTRI-Security at HITB Europe

Gents, TEHTRI-Security was invited to give a talk called "Web In The Middle, Attacking Clients", at the first Hack In The Box Europe, Amsterdam http://conference.hackinthebox.org/hitbsecconf2010ams/ . During our talk, we released multiple advisories and we explained many issues related to some...

Multiple mobile platforms security vulnerabilities

CFNetwork API buffer overflow and more...

CVE-2010-1752

Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to URL handling...

Stack overflow

Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to URL handling...

CVE-2010-1752

CVE-2010-1752 is a CFNetwork stack overflow in iOS (Apple) URL handling, affecting iOS before 4 on iPhone/iPod touch. The vulnerability allows remote attackers to cause a crash or execute arbitrary code via crafted web content. Connected sources (Apple security advisories HT4225/HT4435) indicate ...

CVE-2010-1752

Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to URL handling...

CVE-2010-1752: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in CFNetwork in Apple iOS before 4 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to URL handling...

PT-2010-3390 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 4 Description: A stack-based buffer overflow issue in CFNetwork allows remote attackers to execute arbitrary code or cause a denial of service, specifically an application crash, via vectors related to URL handling...