Detections
Analytics

OmniWeb Browser < 5.5.2 Javascript alert Function Format String

medium Nessus Network Monitor Plugin ID 3879

Synopsis

The remote host is vulnerable to a 'format string' flaw.

Description

The remote host is using Omniweb, an alternative web browser for the Mac OS platform. This version of OmniWeb is vulnerable to a format-string flaw. Specifically, the Javascript 'alert' function fails to correctly parse specially formatted strings. An attacker exploiting this flaw would need the ability to pass malformed strings to the browser. This typically involves being able to entice a user into browsing to a malicious site. Successful exploitation would result in the attacker executing arbitrary code within the browser.

Solution

Upgrade to version 5.5.2 or higher.

See Also

http://www.omnigroup.com/applications/omniweb

Plugin Details

Severity: Medium

ID: 3879

Family: Web Clients

Published: 1/8/2007

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.8

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.9

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:omnigroup:omniweb

Reference Information

CVE: CVE-2007-0148

BID: 21911