NVD

Id
48869  
Name
CVE-2009-1600  
Description
Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe"s position is "a PDF file is active content."  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-05-11  
Modified Date
2009-05-14  
Seq
2009-1600  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
246949 48869 CVE-2009-1600 http://secniche.org/papers/SNS_09_03_PDF_Silent_Form_Re_Purp_Attack.pdf  View
246950 48869 CVE-2009-1600 20090503 [SecNiche WhitePaper ] - PDF Silent HTTP Form Repurposing Attacks  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42394 JVNDB-2009-003401 Apple Safari におけるドキュメントオブジェクトへのアクセス制限を回避される脆弱性 Apple Safari は、インライン PDF ファイルに含まれるフォームの submit 要素の target 属性の javascript: URI に対するレスポンス内で DOM 呼び出しを実行するため、ドキュメントオブジェクトにアクセスする際の Adobe Acrobat JavaScript の制限を回避される脆弱性が存在します。 CVE-2009-1600 39031 CVE-2009-1600 48869 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003401.html 2009-05-11 2012-06-26 View