CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.8 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, was found in Apple Safari up to 5.1.7 (Web Browser). Affected is an unknown part of the component IDN/Unicode Fonts. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on integrity. CVE summarizes:
Incomplete blacklist vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, by leveraging the availability of IDN support and Unicode fonts to construct unspecified homoglyphs.
The weakness was disclosed 07/25/2012 by Matt Cooley (Slawomir Blazek) with Symantec as HT5400 as confirmed knowledge base article (Apple Security Announce). The advisory is available at support.apple.com. The public release has been coordinated in cooperation with the vendor. This vulnerability is traded as CVE-2012-3693 since 06/19/2012. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a private exploit is available.
It is declared as proof-of-concept.
Upgrading to version 6 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The entries 4654, 4645, 4650 and 5585 are pretty similar.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 4.8
VulDB Base Score: 5.3
VulDB Temp Score: 4.8
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Authentication spoofingCWE: CWE-290 / CWE-287
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Access: Private
Status: Proof-of-Concept
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 802924
OpenVAS Name: Apple Safari Multiple Vulnerabilities - July 2012 (Mac OS X)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: Safari 6
Timeline
06/19/2012 🔍07/25/2012 🔍
07/25/2012 🔍
07/25/2012 🔍
07/26/2012 🔍
07/26/2012 🔍
07/27/2012 🔍
08/08/2012 🔍
04/29/2018 🔍
Sources
Vendor: apple.comAdvisory: HT5400
Researcher: Matt Cooley (Slawomir Blazek)
Organization: Symantec
Status: Confirmed
Confirmation: 🔍
Coordinated: 🔍
CVE: CVE-2012-3693 (🔍)
OVAL: 🔍
SecurityTracker: 1027307
Secunia: 50058 - Apple Safari for Mac OS X Multiple Vulnerabilities, Highly Critical
OSVDB: 84205
scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍
Entry
Created: 08/08/2012 12:51Updated: 04/29/2018 00:08
Changes: 08/08/2012 12:51 (68), 04/29/2018 00:08 (7)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.