CVE-2007-2401 | BDVDB-2026-24872 Detail
Description#
CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.vupen.com/english/advisories/2007/2316
- http://docs.info.apple.com/article.html?artnum=306173
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35017
- http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html
- http://secunia.com/advisories/25786
- http://www.westpoint.ltd.uk/advisories/wp-07-0002.txt
- http://secunia.com/advisories/26287
- http://www.securityfocus.com/archive/1/472198/100/0/threaded
- http://docs.info.apple.com/article.html?artnum=305759
- http://www.securityfocus.com/bid/24598
- http://www.vupen.com/english/advisories/2007/2731
- http://osvdb.org/36449
- http://www.securitytracker.com/id?1018281
- http://www.vupen.com/english/advisories/2007/2296
- http://www.kb.cert.org/vuls/id/845708
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.