[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12
From: Jonathan Rockway <jrockw2 () uic ! edu>
Date: 2005-02-04 12:10:10
Message-ID: 90d6eea4e8f0b3216d26c631c3526f73 () uic ! edu
[Download RAW message or body]
Input Validation Vulnerability in Apple Safari version 1.2.4 v125.12
Apple's Safari web browser ignores the Content-type: sent by the web
server. As a result, plain text is rendered as HTML. This is
obviously undesirable; a text file could contain HTML and carry out an
XSS attack.
For an example of this in action, visit:
http://tigger.uic.edu/htbin/perlwrap/jrockw2/safari_test.pl
This will only work if you are on the UIC campus, if you have a login
at UIC, UIUC, or UIS you can visit:
https://tigger.uic.edu/htbin/perlwrap-auth/jrockw2/safari_test.pl
Anyway, for the 99.99% of you not affiliated with the University of
Illinois, this script simply prints:
--
Content-type: text/plain
<HTML><BODY><FONT color="red">Your browser contains a security problem
if this text is red.</FONT></BODY></HTML>
--
sans the --'s, obviously.
In Safari, the text is red. In Firefox 1.0, the text is rendered
appropriately; i.e. the user sees the tag soup.
The security problem is that servers serving HTML may be taking
measures to prevent XSS attacks; i.e. they convert < to <. These
servers, when serving plain text, may not do this (because it is
unnecessary and undesirable). Safari opens up a hole where a malicious
user could inject HTML into a plain text output and perform an XSS
attack that would not work otherwise (with a proper browser).
The latest version of this advisory is viewable at
http://tigger.uic.edu/~jrockw2/safari_20050204.txt
Note that it won't render properly in Safari :-)
Regards,
--
Jonathan Rockway <jrockway@computer.org>
Student - University of Illinois at Chicago
http://www.uic.edu/~jrockw2/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic