Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTION_SHELL_EXECUTE_HIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files.

The version of Safari installed on the remote host reportedly is affected by several issues :

  - An out-of-bounds memory read while handling BMP and GIF     images may lead to information disclosure     (CVE-2008-1573).

  - Safari will automatically launch executable files     downloaded from a site if that site is in an IE7 zone     with 'Launching applications and unsafe files' set to     'Enable' or an IE6 'Local intranet ' / ' Trusted sites'     zone (CVE-2008-2306).

  - There is a memory corruption issue in WebKit's     handling of JavaScript arrays that could be leveraged     to crash the application or execute arbitrary code     if visiting a malicious site (CVE-2008-2307).

  - When handling an object with an unrecognized content     type, Safari does not prompt the user before     downloading the object (aka, the 'carpet-bombing'     issue). If the download location is the Windows     Desktop (the default), this could lead to arbitrary     code execution (CVE-2008-2540).

The version of Safari installed on the remote host reportedly is affected by several issues :

  - An out-of-bounds memory read while handling BMP and GIF images may lead to information disclosure (CVE-2008-1573).
  - Safari will automatically launch executable files downloaded from a site if that site is in an IE7 zone with 'Launching applications and unsafe files' set to 'Enable' or an IE6 'Local intranet ' / ' Trusted sites' zone (CVE-2008-2306).
  - There is a memory corruption issue in WebKit's handling of JavaScript arrays that could be leveraged to crash the application or execute arbitrary code if visiting a malicious site (CVE-2008-2307).
  - When handling an object with an unrecognized content type, Safari does not prompt the user before downloading the object (aka, the 'carpet-bombing' issue). If the download location is the Windows Desktop (the default), this could lead to arbitrary code execution (CVE-2008-2540).

The version of Safari installed on the remote host reportedly is affected by several issues :

  - An out-of-bounds memory read while handling BMP and GIF images may lead to information disclosure (CVE-2008-1573).
  - Safari will automatically launch executable files downloaded from a site if that site is in an IE7 zone with 'Launching applications and unsafe files' set to 'Enable' or an IE6 'Local intranet ' / ' Trusted sites' zone (CVE-2008-2306).
  - There is a memory corruption issue in WebKit's handling of JavaScript arrays that could be leveraged to crash the application or execute arbitrary code if visiting a malicious site (CVE-2008-2307).
  - When handling an object with an unrecognized content type, Safari does not prompt the user before downloading the object (aka, the 'carpet-bombing' issue). If the download location is the Windows Desktop (the default), this could lead to arbitrary code execution (CVE-2008-2540).
IAVT Reference : 2009-T-0021
STIG Finding Severity : Category II

ID	Name	Product	Family	Severity
33226	Safari < 3.1.2 Multiple Vulnerabilities	Nessus	Windows	high
4556	Safari < 3.1.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
800992	Safari < 3.1.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-2306

critical

Tenable Plugins

high

medium

high