NVD

Id
2448  
Name
CVE-2008-2540  
Description
Apple Safari on Mac OS X, and before 3.1.2 on Windows, does not prompt the user before downloading an object that has an unrecognized content type, which allows remote attackers to place malware into the (1) Desktop directory on Windows or (2) Downloads directory on Mac OS X, and subsequently allows remote attackers to execute arbitrary code on Windows by leveraging an untrusted search path vulnerability in (a) Internet Explorer 7 on Windows XP or (b) the SearchPath function in Windows XP, Vista, and Server 2003 and 2008, aka a "Carpet Bomb" and a "Blended Threat Elevation of Privilege Vulnerability," a different issue than CVE-2008-1032. NOTE: Apple considers this a vulnerability only because the Microsoft products can load application libraries from the desktop and, as of 20080619, has not covered the issue in an advisory for Mac OS X.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-06-03  
Modified Date
2016-11-08  
Seq
2008-2540  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
15517 2448 CVE-2008-2540 http://aviv.raffon.net/2008/05/31/SafariPwnsInternetExplorer.aspx  View
15518 2448 CVE-2008-2540 http://blogs.zdnet.com/security/?p=1230  View
15519 2448 CVE-2008-2540 APPLE-SA-2008-06-19  View
15520 2448 CVE-2008-2540 oval:org.mitre.oval:def:5782  View
15521 2448 CVE-2008-2540 oval:org.mitre.oval:def:6108  View
15522 2448 CVE-2008-2540 oval:org.mitre.oval:def:8509  View
15523 2448 CVE-2008-2540 1020150  View
15524 2448 CVE-2008-2540 http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm  View
15525 2448 CVE-2008-2540 http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138  View
15526 2448 CVE-2008-2540 http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html  View
15527 2448 CVE-2008-2540 http://www.microsoft.com/technet/security/advisory/953818.mspx  View
15528 2448 CVE-2008-2540 MS09-014  View
15529 2448 CVE-2008-2540 MS09-015  View
15530 2448 CVE-2008-2540 29445  View
15531 2448 CVE-2008-2540 1022047  View
15532 2448 CVE-2008-2540 TA09-104A  View
15533 2448 CVE-2008-2540 ADV-2008-1706  View
15534 2448 CVE-2008-2540 ADV-2009-1028  View
15535 2448 CVE-2008-2540 ADV-2009-1029  View
15536 2448 CVE-2008-2540 apple-safari-windows-code-execution(42765)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46109 JVNDB-2008-001419 Apple Safari における ダウンロード前に警告が表示されない脆弱性 Apple Safari には、未知の content type のオブジェクトのダウンロード前にプロンプトを表示しない脆弱性が存在します。 CVE-2008-2540 32653 CVE-2008-2540 2448 9.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001419.html 2008-05-31 2009-05-15 View