CVE-2007-3757: Input Validation

Published Sep 27, 2007

Updated

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed.

Affected Software

4 affected components

Apple iPhone=1.0

iPhone OS=1.0.1

iPhone OS=1.0.2

Safari

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2007/Sep/msg00001.html

Event History

Sep 27, 2007

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

09:17 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2007-3757?

CVE-2007-3757 has been classified as a vulnerability that can lead to user-assisted call hijacking.

How do I fix CVE-2007-3757?

To fix CVE-2007-3757, update to a version of Safari that addresses this issue and avoid clicking on untrusted 'tel:' links.

What types of devices are affected by CVE-2007-3757?

CVE-2007-3757 specifically affects Safari on Apple iPhone OS versions prior to updates that address the issue.

Can CVE-2007-3757 be exploited remotely?

Yes, CVE-2007-3757 can be exploited remotely if a user is tricked into interacting with a crafted 'tel:' link.

Is user interaction required for CVE-2007-3757 exploitation?

Yes, exploitation of CVE-2007-3757 requires user interaction to click on the malicious link.