Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Macintosh :: tb11272.htm

Apple Safari: cookie stealing



Apple Safari: cookie stealing
Apple Safari: cookie stealing




There is a vulnerability in Apple Safari, that allows an attacker to
steal a cookie belonging to the arbitrary domain or/and fill the browser
window with an arbitrary content, whereas the url bar and the browser's
window title is derived from the selected domain.

The flaw exists in the javascript's window.setTimeout() implementation.
The content of the timer-triggered function is processed after
window.location property is changed.

Tested with Apple Safari 3.0 (522.11.3) on MS Windows 2003 SE SP2

http://alt.swiecki.net/safc.html 

-- 
Robert Swiecki
http://www.swiecki.net 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH