CVE-2006-0848
macOS X - Remote Code Execution via Safari Safe Files Download Feature
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-0848.
PoCs published by Metasploit, hdm, including Metasploit module exploits/osx/browser/safari_metadata_archive.
AI-analyzed exploit summary This Metasploit module exploits CVE-2006-0848 in Safari by crafting a malicious ZIP archive with a shell script and metadata to force execution via Terminal.app. It requires the 'zip' utility and targets macOS Safari users.
Description
The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.
Exploits (2)
This Metasploit module exploits CVE-2006-0848 in Safari by crafting a malicious ZIP archive with a shell script and metadata to force execution via Terminal.app. It requires the 'zip' utility and targets macOS Safari users.
This Metasploit module exploits a command execution flaw in Safari's 'Safe file' feature by delivering a malicious ZIP archive containing a shell script disguised as a .mov file with metadata to trigger Terminal.app execution.