NVD脆弱性詳細

CVE-2009-1724

概要	Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
概要	Una vulnerabilidad de tipo cross-site scripting (XSS) en WebKit en Safari de Apple anterior a versión 4.0.2, tal y como es usado en iPhone OS anterior a versión 3.1, iPhone OS anterior a versión 3.1.1 para iPod touch, y otras plataformas, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de vectores relacionados con los objetos primarios y superiores.
公表日	2009年7月10日2:30
登録日	2021年1月29日13:18
最終更新日	2026年4月23日9:35

CVSS2.0 : MEDIUM
スコア	4.3
ベクター	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	はい

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:apple:safari::::::::		4.0.1
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1:beta::::::
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:4.0:::::::*
cpe:2.3:a:apple:safari:4.0.0b:::::::*
cpe:2.3:o:apple:iphone_os::::::::		3.0.1
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os::::::::		3.1
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:o:apple:iphone_os::::::::
cpe:2.3:h:apple:ipod_touch::::::::

関連情報、対策とツール

No	URL	refsource
1	http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html	cve@mitre.org
2	http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html	cve@mitre.org
3	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	cve@mitre.org
4	http://osvdb.org/55738	cve@mitre.org
5	http://secunia.com/advisories/35758	cve@mitre.org
6	http://secunia.com/advisories/36677	cve@mitre.org
7	http://secunia.com/advisories/43068	cve@mitre.org
8	http://support.apple.com/kb/HT3666	cve@mitre.org
9	http://support.apple.com/kb/HT3860	cve@mitre.org
10	http://www.securityfocus.com/bid/35441	cve@mitre.org
11	http://www.securitytracker.com/id?1022525	cve@mitre.org
12	http://www.vupen.com/english/advisories/2009/1827	cve@mitre.org
13	http://www.vupen.com/english/advisories/2011/0212	cve@mitre.org
14	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6208	cve@mitre.org
15	http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html	af854a3a-2127-422b-91ae-364da2661108
16	http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html	af854a3a-2127-422b-91ae-364da2661108
17	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	af854a3a-2127-422b-91ae-364da2661108
18	http://osvdb.org/55738	af854a3a-2127-422b-91ae-364da2661108
19	http://secunia.com/advisories/35758	af854a3a-2127-422b-91ae-364da2661108
20	http://secunia.com/advisories/36677	af854a3a-2127-422b-91ae-364da2661108
21	http://secunia.com/advisories/43068	af854a3a-2127-422b-91ae-364da2661108
22	http://support.apple.com/kb/HT3666	af854a3a-2127-422b-91ae-364da2661108
23	http://support.apple.com/kb/HT3860	af854a3a-2127-422b-91ae-364da2661108
24	http://www.securityfocus.com/bid/35441	af854a3a-2127-422b-91ae-364da2661108
25	http://www.securitytracker.com/id?1022525	af854a3a-2127-422b-91ae-364da2661108
26	http://www.vupen.com/english/advisories/2009/1827	af854a3a-2127-422b-91ae-364da2661108
27	http://www.vupen.com/english/advisories/2011/0212	af854a3a-2127-422b-91ae-364da2661108
28	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6208	af854a3a-2127-422b-91ae-364da2661108

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

構成1	以上	以下	より上	未満
cpe:2.3:a:apple:safari::::::::		4.0.1
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1:beta::::::
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:4.0:::::::*
cpe:2.3:a:apple:safari:4.0.0b:::::::*
cpe:2.3:o:apple:iphone_os::::::::		3.0.1
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os::::::::		3.1
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*