製品・ソフトウェアに関する情報

JVN脆弱性詳細

WebKit におけるクロスサイトリクエストフォージェリの脆弱性

Title	WebKit におけるクロスサイトリクエストフォージェリの脆弱性
Summary	Apple Safari 等で使用されている WebKit には、OPTIONS リクエストにカスタム HTTP ヘッダを含むため、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	巧妙に細工された Web ページにより、第三者にクロスサイトリクエストフォージェリ攻撃を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 11, 2009, midnight
Registration Date	Jan. 7, 2010, 12:09 p.m.
Last Update	July 13, 2010, 4:28 p.m.

CVSS2.0 : 警告
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected System

アップル

Apple Mac OS X v10.4.11

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6.1

Apple Mac OS X v10.6.2

Apple Mac OS X Server v10.4.11

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6.1

Apple Mac OS X Server v10.6.2

iOS 2.0 から 3.1.3

iOS for iPod touch 2.1 から 3.1.3

iPhone

iPod touch

Safari 4.0.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-2816	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2816
National Vulnerability Database (NVD)
2	CVE-2009-2816	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2816

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT3949	http://support.apple.com/kb/HT3949
2	HT4225	http://support.apple.com/kb/HT4225
Apple セキュリティアップデート
3	HT3949	http://support.apple.com/kb/HT3949?viewlocale=ja_JP
4	HT4225	http://support.apple.com/kb/HT4225?viewlocale=ja_JP

その他

No	Name	URL
ISS X-Force Database
1	54239	http://xforce.iss.net/xforce/xfdb/54239
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
2	59940	http://osvdb.org/59940
Secunia Advisory
3	SA37346	http://secunia.com/advisories/37346
SecurityFocus
4	36997	http://www.securityfocus.com/bid/36997
SecurityTracker
5	1023165	http://www.securitytracker.com/id?1023165
VUPEN Security
6	VUPEN/ADV-2009-3217	http://www.vupen.com/english/advisories/2009/3217

Change Log

No	Changed Details	Date of change
0	[2010年01月07日] 掲載 [2010年07月13日] 影響を受けるシステム：アップル (HT4225) の情報を追加ベンダ情報：アップル (HT4225) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-2816

Summary	The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
Publication Date	Nov. 14, 2009, 12:30 a.m.
Registration Date	Jan. 29, 2021, 1:21 p.m.
Last Update	Nov. 9, 2021, 6:43 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apple:safari::::::::				4.0.4
cpe:2.3:a:google:chrome::::::::				3.0.195.33
cpe:2.3:o:apple:iphone_os::::::::				4.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:11.2:::::::*
cpe:2.3:o:opensuse:opensuse:11.3:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:11:::::::*
cpe:2.3:o:fedoraproject:fedora:12:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://support.apple.com/kb/HT3949	CONFIRM	Patch Vendor Advisory
2	http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html	APPLE	Mailing List Patch Vendor Advisory
3	https://bugzilla.redhat.com/show_bug.cgi?id=525789	CONFIRM	Issue Tracking Third Party Advisory
4	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00545.html	FEDORA	Third Party Advisory
5	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00549.html	FEDORA	Third Party Advisory
6	http://secunia.com/advisories/37346	SECUNIA	Third Party Advisory
7	http://www.vupen.com/english/advisories/2009/3217	VUPEN	Vendor Advisory
8	http://www.securityfocus.com/bid/36997	BID	Third Party Advisory VDB Entry
9	http://secunia.com/advisories/37358	SECUNIA	Third Party Advisory
10	http://www.vupen.com/english/advisories/2009/3233	VUPEN	Vendor Advisory
11	http://secunia.com/advisories/37397	SECUNIA	Third Party Advisory
12	http://osvdb.org/59940	OSVDB	Broken Link
13	http://osvdb.org/59967	OSVDB	Broken Link
14	http://www.securitytracker.com/id?1023165	SECTRACK	Third Party Advisory VDB Entry
15	http://secunia.com/advisories/37393	SECUNIA	Third Party Advisory
16	http://support.apple.com/kb/HT4225	CONFIRM	Vendor Advisory
17	http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	APPLE	Mailing List Vendor Advisory
18	http://secunia.com/advisories/43068	SECUNIA	Third Party Advisory
19	http://www.vupen.com/english/advisories/2011/0212	VUPEN	Vendor Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	SUSE	Third Party Advisory
21	https://exchange.xforce.ibmcloud.com/vulnerabilities/54239	XF	Third Party Advisory VDB Entry
22	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6516	OVAL	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html