iDefense Security Advisory 10.12.11: Apple MobileSafari Attachment Viewing Cross Site Scripting Vulnerability

iDefense Security Advisory 10.12.11
http://labs.idefense.com/intelligence/vulnerabilities/
Oct 12, 2011

I. BACKGROUND

MobileSafari is Apple's mobile we browser for iOS devices. For more
information about MobileSafari, please the visit following website:

http://www.apple.com/iphone/built-in-apps/safari.html

II. DESCRIPTION

Remote exploitation of a cross site scripting vulnerability in Apple
Inc.'s MobileSafari could allow an attacker to view sensitive
information in the context of the targeted domain.

This vulnerability occurs in MobileSafari's handling of the
Content-Disposition header, which is typically used to inform the
browser that an attachment is contained in the current response. Typical
browser behavior is to prompt the user with an Open dialog, asking them
how they would like to handle the attachment content (such as opening an
external program). However, MobileSafari does not prompt the user, and
instead opens the attached content in the browser. If an attacker can
persuade a target to open an HTML attachment (such as by attaching an
HTML file to an email), then this file will open in the context of the
domain serving the file. This allows the HTML attachment full access to
the DOM of the targeted domain, which can allow for cross site
scripting.

III. ANALYSIS

Exploitation of this vulnerability results in the disclosure of
potentially sensitive information, such as document cookies, on the
target domain. To exploit this vulnerability, a targeted user must open
an attachment from an affected domain. An attacker typically
accomplishes this via social engineering or injecting content into
compromised, trusted sites. Note that a user has to open an attachment,
which takes at least one click; however, MobileSafari does not display
an "Open" prompt dialog, so nothing beyond the initial click is
necessary.

IV. DETECTION

iOS versions prior to 5 are vulnerable.

V. WORKAROUND

iDefense is currently unaware of any workarounds for this issue.

VI. VENDOR RESPONSE

Apple has released a fix which addresses this issue. Information about
downloadable vendor updates can be found by clicking on the URLs shown.

http://lists.apple.com/archives/Security-announce/2011/Oct/msg00001.html

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2011-3426 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

03/02/2011 Initial Vendor Notification
03/02/2011 Vendor Reply
10/12/2011 Coordinated Public Disclosure

IX. CREDIT

This vulnerability was reported to iDefense by Christian Matthies.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright A© 2011 Verisign

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
e-mail [email protected] for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.