Home / vulnerabilities

PDF

Apple Safari 8.0.8 URI Spoofing

Posted on 06 October 2015
Source : packetstormsecurity.org Link

 

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability (and more general a user interface spoofing). Apple released security updates for Safari 9<https://support.apple.com/kb/HT205265> on OS X and assigned CVE-2015-5764. Accidentally this vulnerability was also present in iOS.

Instant demo
In Safari up to 8.0.8 :

* go to https://asanso.github.io/CVE-2015-5764/file0.html
* click "click me!"
* notice the address bar being "data:text/html,%3CH1%3EHi!!%3C/H1%3E"
* go back using the browser button
* click "click me!"
* notice the address bar being http://www.intothesymmetry.com/CVE-2015-5764/file0.php !!!!

You can find the details in http://intothesymmetry.blogspot.it/2015/09/apple-safari-uri-spoofing-cve-2015-5764.html

regards

antonio

 

TOP