CVE-2015-1126

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html	Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html	Vendor Advisory
http://www.securitytracker.com/id/1032047
https://support.apple.com/HT204658	Vendor Advisory
https://support.apple.com/HT204661	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:a:apple:safari:7.0:::::::*
	cpe:2.3:a:apple:safari:7.0.1:::::::*
	cpe:2.3:a:apple:safari:7.0.2:::::::*
	cpe:2.3:a:apple:safari:7.0.3:::::::*
	cpe:2.3:a:apple:safari:7.0.4:::::::*
	cpe:2.3:a:apple:safari:7.0.5:::::::*
	cpe:2.3:a:apple:safari:7.0.6:::::::*
	cpe:2.3:a:apple:safari:7.1.0:::::::*
	cpe:2.3:a:apple:safari:7.1.1:::::::*
	cpe:2.3:a:apple:safari:7.1.2:::::::*
	cpe:2.3:a:apple:safari:7.1.3:::::::*
	cpe:2.3:a:apple:safari:7.1.4:::::::*
	cpe:2.3:a:apple:safari:8.0.0:::::::*
	cpe:2.3:a:apple:safari:8.0.1:::::::*
	cpe:2.3:a:apple:safari:8.0.2:::::::*
	cpe:2.3:a:apple:safari:8.0.3:::::::*
	cpe:2.3:a:apple:safari:8.0.4:::::::*

History

No history.

Information

Published : 2015-04-10 14:59

Updated : 2024-02-04 18:35

NVD link : CVE-2015-1126

Mitre link : CVE-2015-1126

CVE.ORG link : CVE-2015-1126

JSON object : View

Products Affected

apple

iphone_os
safari

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2015-1126", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-04-10T14:59:39.713", "references": [{"url": "http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://www.securitytracker.com/id/1032047", "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT204658", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT204661", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors."}, {"lang": "es", "value": "WebKit, utilizado en Apple iOS anterior a 8.3 y Apple Safari anterior a 6.2.5, 7.x anterior a 7.1.5, y 8.x anterior a 8.0.5, no maneja correctamente el campo userinfo en las URLs FTP, lo que permite a atacantes remotos provocar el acceso a recursos incorrecto a trav\u00e9s de vectores no especificados."}], "lastModified": "2015-09-11T17:57:26.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0340315-35F7-4736-854B-852916D00673", "versionEndIncluding": "8.2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E082F5D0-4261-4D84-8E4C-9D425028BFDA", "versionEndIncluding": "6.2.4"}, {"criteria": "cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88D46FE5-10D2-44A0-ACAE-CEED8BD0C30C"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "391B4255-4434-4EB3-929B-3E593D9CD249"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40B87D10-55B3-42E7-8FF6-93EDF003337D"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D4EBCD8-9DD5-468E-8B5B-49E38FEBCEC2"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B8C7AEC-F54A-4843-A0EA-C7DD847BEF5B"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49457917-495E-4D17-A0AB-D2A163D4721D"}, {"criteria": "cpe:2.3:a:apple:safari:7.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CCADCE6-92F3-4A30-AA29-4E3394C1A3CF"}, {"criteria": "cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E74D3F4B-111E-4F51-ACB4-6725C4BF8DB6"}, {"criteria": "cpe:2.3:a:apple:safari:7.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "223B13DA-9328-46C2-8426-3182D55E6669"}, {"criteria": "cpe:2.3:a:apple:safari:7.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD636DF3-E590-4603-9D18-CC2375A97750"}, {"criteria": "cpe:2.3:a:apple:safari:7.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0F8336F-D0F8-4337-9DF6-51B60F8A2E9B"}, {"criteria": "cpe:2.3:a:apple:safari:7.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79C2EF49-A9F0-4612-903A-A3A95805277E"}, {"criteria": "cpe:2.3:a:apple:safari:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "845A67F0-7BE6-482C-AE49-D8E9B272BA6C"}, {"criteria": "cpe:2.3:a:apple:safari:8.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB1C61F7-BAF4-4061-8B1A-D7F8D597F2D5"}, {"criteria": "cpe:2.3:a:apple:safari:8.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A5C7D83-EA9E-4E26-910D-8471252723EF"}, {"criteria": "cpe:2.3:a:apple:safari:8.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE29EE2D-9EA8-4486-BC3F-B0CCF9C396F6"}, {"criteria": "cpe:2.3:a:apple:safari:8.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FDB5E2A-F3BD-4500-922E-A191C45DE93C"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}