iDefense Security Advisory 10.12.11: Apple MobileSafari Attachment Viewing Cross Site Scripting Vulnerability

iDefense Security Advisory 10.12.11 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 12, 2011 I. BACKGROUND MobileSafari is Apple's mobile we browser for iOS devices. For more information about MobileSafari, please the visit following website:...

CVE-2011-3426

Cross-site scripting XSS vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header...

Cross site scripting

Cross-site scripting XSS vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header...

Apple MobileSafari附件查看跨站脚本执行漏洞

CVE ID: CVE-2011-3426 MobileSafari是Apple的iOS设备的浏览器。 Apple公司的MobileSafari在处理Content-Disposition标头时存在安全漏洞，在不提示用户的情况下就打开附件内容，导致附件可以完全访问目标域的DOM，执行跨站脚本攻击，泄露敏感信息。攻击者通常使用社会工程学攻击或向受控站点插入内容。 Apple iOS 5 厂商补丁： Apple ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://support.apple.com/...

BuzzyWall 1.3.2 File Disclosure

BuzzyWall 1.3.2 resolute.php Local File Disclosure Exploit Found by cr4wl3r @hackb0x d0rk: no d0rk f0r kiddi0ts Script: http://sourceforge.net/projects/buzzywall/files/buzzywall/ err0r c0de resolute.php ?PHP header "Content-type: image/jpeg"; $img = $GET'img'; header'Content-Disposition:...

CVE-2011-3000

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...

Mozilla: Defense against multiple Location headers due to CRLF Injection (MFSA 2011-39)

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...

Inline attachment downloads vulnerable to XSS by setting tweaked HTML content type

Please see CONFDEV-9069 https://jira.atlassian.com/browse/CONFDEV-9069 for the current issue addressed at fixing attachment XSS vulnerabilities. --- TLDR: white-list mime-types which can be served "inline" and don't let the user set arbitrary mime-types. I have been having a good laugh sorry...

Path traversal

Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ backslash as a separator of path components within the Content-disposition HTTP header...

CVE-2010-3842

CVE-2010-3842 affects the curl command-line tool, specifically versions 7.20.0 through 7.21.1. The root cause is improper handling of backslashes as directory separators in the Content-Disposition header when using --remote-header-name (-J). This allows a remote server to cause the client to writ...

FreeBSD Ports: lftp

The remote host is missing an update to the system as announced in the referenced advisory. VID 29b7e3f4-b6a9-11df-ae63-f255a795cb21 OpenVAS Vulnerability Test $ Description: Auto generated from VID 29b7e3f4-b6a9-11df-ae63-f255a795cb21 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

FreeBSD Ports: lftp

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Ubuntu Update for lftp vulnerability USN-984-1

Ubuntu Update for Linux kernel vulnerabilities USN-984-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9841.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for lftp vulnerability USN-984-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-984-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : lftp vulnerability (USN-984-1)

It was discovered that LFTP incorrectly filtered filenames suggested by Content-Disposition headers. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name, such as a dotfile, and possibly run...

USN-984-1: LFTP vulnerability

It was discovered that LFTP incorrectly filtered filenames suggested by Content-Disposition headers. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name, such as a dotfile, and possibly run...

Ubuntu Update for libwww-perl vulnerability USN-981-1

Ubuntu Update for Linux kernel vulnerabilities USN-981-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9811.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for libwww-perl vulnerability USN-981-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-981-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : lftp -- multiple HTTP client download filename vulnerability (29b7e3f4-b6a9-11df-ae63-f255a795cb21)

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

[ MDVSA-2010:167 ] perl-libwww-perl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:167 http://www.mandriva.com/security/ Package : perl-libwww-perl Date : August 31, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 Problem Description: A...