Vulnerability CVE-2009-1716 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1716 (CCN-51221)

Assigned:

2009-06-08

Published:

2009-06-08

Updated:

2009-06-19

Summary:

CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2009-1716

Source: APPLE
Type: Patch, Vendor Advisory
APPLE-SA-2009-06-08-1

Source: CCN
Type: SA35379
Apple Safari Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
35379

Source: CCN
Type: SECTRACK ID: 1022342
Apple Safari Lets Local Users Access Files During Downloading

Source: SECTRACK
Type: UNKNOWN
1022342

Source: CCN
Type: Apple Web site
About the security content of Safari 4.0

Source: CONFIRM
Type: Patch, Vendor Advisory
http://support.apple.com/kb/HT3613

Source: CCN
Type: OSVDB ID: 54995
Apple Safari CFNetwork Temporary File Local Information Disclosure

Source: BID
Type: Exploit, Patch
35260

Source: CCN
Type: BID-35260
RETIRED: Apple Safari Prior to 4.0 Multiple Security Vulnerabilities

Source: BID
Type: UNKNOWN
35347

Source: CCN
Type: BID-35347
Apple Safari CFNetwork Downloaded Files Information Disclosure Vulnerability

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-1522

Source: XF
Type: UNKNOWN
safari-cfnetwork-information-disclosure(51221)

Vulnerable Configuration:

Configuration 1:

cpe:/a:apple:safari:0.8:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:0.9:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.0.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0.4:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:*:-:mac:*:*:*:*:* (Version <= 4.0_beta)

Configuration 2:

cpe:/a:apple:safari:3.0:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:*:-:windows:*:*:*:*:* (Version <= 3.2.3)

Configuration CCN 1:

cpe:/a:apple:safari:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:2.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:0.8:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:4.0:beta:*:*:*:*:*:*

OR cpe:/a:apple:safari:0.9:*:*:*:*:*:*:*

Denotes that component is vulnerable