International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

From Red Hat Security Advisory 2009:1122 :

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve this issue.

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153)

It was discovered that the ICU unicode library performed incorrect processing of invalid multibyte sequences, resulting in potential bypass of security mechanisms.

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The International Components for Unicode (ICU) library provides robust and full-featured Unicode services.

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153)

All users of icu should upgrade to these updated packages, which contain backported patches to resolve this issue.

It was discovered that ICU did not properly handle invalid byte sequences during Unicode conversion. If an application using ICU processed crafted data, content security mechanisms could be bypassed, potentially leading to cross-site scripting (XSS) attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting (XSS) attacks (CVE-2009-0153).

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting (XSS) attacks. (CVE-2009-0153)

CVE-2009-0153 Handle illegal sequences consistently

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Safari installed on the remote Windows host is earlier than 4.0.  It therefore is potentially affected by numerous issues in the following components :

  - CFNetwork
  - CoreGraphics
  - ImageIO
  - International Components for Unicode
  - libxml
  - Safari
  - Safari Windows Installer
  - WebKit

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
67878	Oracle Linux 5 : icu (ELSA-2009-1122)	Nessus	Oracle Linux Local Security Checks	medium
60603	Scientific Linux Security Update : icu on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
44754	Debian DSA-1889-1 : icu - programming error	Nessus	Debian Local Security Checks	medium
43760	CentOS 5 : icu (CESA-2009:1122)	Nessus	CentOS Local Security Checks	medium
42081	Ubuntu 8.04 LTS / 8.10 / 9.04 : icu vulnerability (USN-846-1)	Nessus	Ubuntu Local Security Checks	medium
42005	openSUSE 10 Security Update : icu (icu-6322)	Nessus	SuSE Local Security Checks	medium
41522	SuSE 10 Security Update : icu (ZYPP Patch Number 6422)	Nessus	SuSE Local Security Checks	medium
41402	SuSE 11 Security Update : icu (SAT Patch Number 1029)	Nessus	SuSE Local Security Checks	medium
40651	openSUSE Security Update : icu (icu-1028)	Nessus	SuSE Local Security Checks	medium
40644	openSUSE Security Update : icu (icu-1028)	Nessus	SuSE Local Security Checks	medium
39525	RHEL 5 : icu (RHSA-2009:1122)	Nessus	Red Hat Local Security Checks	medium
39402	Fedora 10 : icu-4.0-3.1.fc10 (2009-6273)	Nessus	Fedora Local Security Checks	medium
39400	Fedora 9 : icu-3.8.1-9.fc9 (2009-6121)	Nessus	Fedora Local Security Checks	medium
39339	Safari < 4.0 Multiple Vulnerabilities	Nessus	Windows	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2009-0153

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

critical

high