NVD Vulnerability Detail

CVE-2011-0217

Summary	Apple Safari before 5.0.6 provides AutoFill information to scripts that execute before HTML form submission, which allows remote attackers to obtain Address Book information via a crafted form, as demonstrated by a form that includes non-visible fields.
Publication Date	July 22, 2011, 8:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:23 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:safari::::::::			5.0.5
cpe:2.3:a:apple:safari:1.0:beta::::::
cpe:2.3:a:apple:safari:1.0:::::::*
cpe:2.3:a:apple:safari:1.0:beta2::::::
cpe:2.3:a:apple:safari:1.0.0:::::::*
cpe:2.3:a:apple:safari:1.0.0b1:::::::*
cpe:2.3:a:apple:safari:1.0.0b2:::::::*
cpe:2.3:a:apple:safari:1.0.1:::::::*
cpe:2.3:a:apple:safari:1.0.2:::::::*
cpe:2.3:a:apple:safari:1.0.3:::::::*
cpe:2.3:a:apple:safari:1.0.3:85.8::::::
cpe:2.3:a:apple:safari:1.0.3:85.8.1::::::
cpe:2.3:a:apple:safari:1.1:::::::*
cpe:2.3:a:apple:safari:1.1.0:::::::*
cpe:2.3:a:apple:safari:1.1.1:::::::*
cpe:2.3:a:apple:safari:1.2:::::::*
cpe:2.3:a:apple:safari:1.2.0:::::::*
cpe:2.3:a:apple:safari:1.2.1:::::::*
cpe:2.3:a:apple:safari:1.2.2:::::::*
cpe:2.3:a:apple:safari:1.2.3:::::::*
cpe:2.3:a:apple:safari:1.2.4:::::::*
cpe:2.3:a:apple:safari:1.2.5:::::::*
cpe:2.3:a:apple:safari:1.3:::::::*
cpe:2.3:a:apple:safari:1.3.0:::::::*
cpe:2.3:a:apple:safari:1.3.1:::::::*
cpe:2.3:a:apple:safari:1.3.2:312.5::::::
cpe:2.3:a:apple:safari:1.3.2:312.6::::::
cpe:2.3:a:apple:safari:1.3.2:::::::*
cpe:2.3:a:apple:safari:2:::::::*
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:4.1:::::::*
cpe:2.3:a:apple:safari:4.1.1:::::::*
cpe:2.3:a:apple:safari:4.1.2:::::::*
cpe:2.3:a:apple:safari:5.0:::::::*
cpe:2.3:a:apple:safari:5.0.1:::::::*
cpe:2.3:a:apple:safari:5.0.2:::::::*
cpe:2.3:a:apple:safari:5.0.3:::::::*
cpe:2.3:a:apple:safari:5.0.4:::::::*
execution environment
1	cpe:2.3:o:apple:mac_os_x:10.6.8:::::::*
2	cpe:2.3:o:apple:mac_os_x:10.6.9:::::::*
3	cpe:2.3:o:apple:mac_os_x:10.7.0:::::::*
4	cpe:2.3:o:apple:mac_os_x_server:10.6.8:::::::*
5	cpe:2.3:o:apple:mac_os_x_server:10.6.9:::::::*
6	cpe:2.3:o:apple:mac_os_x_server:10.7.0:::::::*
7	cpe:2.3:o:microsoft:windows_7::::::::
8	cpe:2.3:o:microsoft:windows_vista::::::::
9	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
10	cpe:2.3:o:microsoft:windows_xp::sp3::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html	Patch Vendor Advisory
2	http://support.apple.com/kb/HT4808	Vendor Advisory
3	http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html	Patch Vendor Advisory
4	http://support.apple.com/kb/HT4808	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Apple Safari における Address Book 情報を取得される脆弱性

Title	Apple Safari における Address Book 情報を取得される脆弱性
Summary	Apple Safari には、Address Book 情報を取得される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された HTML フォームを介して、Address Book 情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 21, 2011, midnight
Registration Date	Aug. 5, 2011, 10:12 a.m.
Last Update	Aug. 5, 2011, 10:12 a.m.

Affected System

アップル

Apple Mac OS X v10.6.8 およびそれ以降

Apple Mac OS X Server v10.6.8 およびそれ以降

Safari 5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0217	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0217
National Vulnerability Database (NVD)
2	CVE-2011-0217	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0217

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4808	http://support.apple.com/kb/HT4808

その他

No	Name	URL
JVN
1	JVNVU#781747	http://jvn.jp/cert/JVNVU781747/index.html
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
2	73995	http://osvdb.org/show/osvdb/73995
Secunia Advisory
3	SA45325	http://secunia.com/advisories/45325
SecurityFocus
4	48839	http://www.securityfocus.com/bid/48839
SecurityTracker
5	1025816	http://securitytracker.com/id/1025816

Change Log

No	Changed Details	Date of change
0	[2011年08月05日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:safari::::::::			5.0.5
cpe:2.3:a:apple:safari:1.0:beta::::::
cpe:2.3:a:apple:safari:1.0:::::::*
cpe:2.3:a:apple:safari:1.0:beta2::::::
cpe:2.3:a:apple:safari:1.0.0:::::::*
cpe:2.3:a:apple:safari:1.0.0b1:::::::*
cpe:2.3:a:apple:safari:1.0.0b2:::::::*
cpe:2.3:a:apple:safari:1.0.1:::::::*
cpe:2.3:a:apple:safari:1.0.2:::::::*
cpe:2.3:a:apple:safari:1.0.3:::::::*
cpe:2.3:a:apple:safari:1.0.3:85.8::::::
cpe:2.3:a:apple:safari:1.0.3:85.8.1::::::
cpe:2.3:a:apple:safari:1.1:::::::*
cpe:2.3:a:apple:safari:1.1.0:::::::*
cpe:2.3:a:apple:safari:1.1.1:::::::*
cpe:2.3:a:apple:safari:1.2:::::::*
cpe:2.3:a:apple:safari:1.2.0:::::::*
cpe:2.3:a:apple:safari:1.2.1:::::::*
cpe:2.3:a:apple:safari:1.2.2:::::::*
cpe:2.3:a:apple:safari:1.2.3:::::::*
cpe:2.3:a:apple:safari:1.2.4:::::::*
cpe:2.3:a:apple:safari:1.2.5:::::::*
cpe:2.3:a:apple:safari:1.3:::::::*
cpe:2.3:a:apple:safari:1.3.0:::::::*
cpe:2.3:a:apple:safari:1.3.1:::::::*
cpe:2.3:a:apple:safari:1.3.2:312.5::::::
cpe:2.3:a:apple:safari:1.3.2:312.6::::::
cpe:2.3:a:apple:safari:1.3.2:::::::*
cpe:2.3:a:apple:safari:2:::::::*
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:4.1:::::::*
cpe:2.3:a:apple:safari:4.1.1:::::::*
cpe:2.3:a:apple:safari:4.1.2:::::::*
cpe:2.3:a:apple:safari:5.0:::::::*
cpe:2.3:a:apple:safari:5.0.1:::::::*
cpe:2.3:a:apple:safari:5.0.2:::::::*
cpe:2.3:a:apple:safari:5.0.3:::::::*
cpe:2.3:a:apple:safari:5.0.4:::::::*
execution environment
1	cpe:2.3:o:apple:mac_os_x:10.6.8:::::::*
2	cpe:2.3:o:apple:mac_os_x:10.6.9:::::::*
3	cpe:2.3:o:apple:mac_os_x:10.7.0:::::::*
4	cpe:2.3:o:apple:mac_os_x_server:10.6.8:::::::*
5	cpe:2.3:o:apple:mac_os_x_server:10.6.9:::::::*
6	cpe:2.3:o:apple:mac_os_x_server:10.7.0:::::::*
7	cpe:2.3:o:microsoft:windows_7::::::::
8	cpe:2.3:o:microsoft:windows_vista::::::::
9	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
10	cpe:2.3:o:microsoft:windows_xp::sp3::::::*