2685Third-party advisory
http://securityreason.com/securityalert/2685 CVE-2007-2580
Apple 2.0.4 - Safari Local Cross-Site Scripting
Record summary
CVE-2007-2580 has a selected CVSS score of 1.9; EIP currently links 1 catalogued exploit.
Description
Unspecified vulnerability in Apple Safari allows local users to obtain sensitive information (saved keychain passwords) via the document.loginform.password.value JavaScript parameter loaded from an AppleScript script.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBApple 2.0.4 - Safari Local Cross-Site ScriptingExploitDB exploitby poplixNot analyzed1 file
References
Showing 12 of 1335569vdb entry
http://www.osvdb.org/35569 20070504 safari's saved password at riskmailing list
http://www.securityfocus.com/archive/1/467676/100/0/threaded 20070514 Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468544/100/0/threaded 20070514 RE: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468585/100/0/threaded 20070514 Re: RE: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468639/100/0/threaded 20070515 RE: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468650/100/0/threaded 20070515 Re: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468719/100/0/threaded 20070516 Re: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468727/100/0/threaded 20070516 RE: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468737/100/0/threaded 20070517 Re: Apple Safari on MacOSX may reveal user's saved passwordsmailing list
http://www.securityfocus.com/archive/1/468869/100/0/threaded 23825vdb entry
http://www.securityfocus.com/bid/23825