CVE-2007-2401

 

Published at: - 25-06-2007 09:30

Last modified: - 09-08-2022 03:46

Total changes: - 2

Description

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:N/I:P/A:N

 

Verification logic

 

Reference

• http://www.westpoint.ltd.uk/advisories/wp-07-0002.txt
• http://docs.info.apple.com/article.html?artnum=305759
• APPLE-SA-2007-06-22-Patch
• VU#845708-US Government Resource
• 24598-Patch
• 1018281-Patch
• 25786-Patch, Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=306173
• 26287-Vendor Advisory
• ADV-2007-2316-
• ADV-2007-2731-
• ADV-2007-2296-
• 36449-
• macos-xmlhttprequest-header-injection(35017)-
• 20070625 Safari XMLHttpRequest HTTP header injection-

 

Keywords

NVD

 

CVE-2007-2401

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures