CVE-2008-2540

Apple Safari < 3.1.2 - Unauthenticated Arbitrary File Download and Code Execution via Unrecognized Content Type

Title source: llm

Description

Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a "Carpet Bomb" and a "Blended Threat Elevation of Privilege Vulnerability," a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.

References (21)

Core 21

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30467

Broken Link vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/1028

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1022047

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1020150

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/29445

Mitigation, Patch, Vendor Advisory x_refsource_misc

http://www.microsoft.com/technet/security/advisory/953818.mspx

Broken Link vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/1029

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA09-104A.html

Third Party Advisory vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8509

Third Party Advisory x_refsource_misc

http://blogs.zdnet.com/security/?p=1230

Third Party Advisory x_refsource_confirm

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014

Broken Link x_refsource_misc

http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html

Mailing List, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html

Third Party Advisory x_refsource_misc

http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx

Third Party Advisory vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5782

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/42765

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-015

Third Party Advisory vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6108

Third Party Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm

Broken Link vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1706

Scores

EPSS 0.0832

EPSS Percentile 94.4%

Details

CWE

CWE-264

Status published

Products (1)

apple/safari < 3.1.2

Published Jun 03, 2008

Tracked Since Feb 18, 2026