CVE-2009-1681: Medium severity Safari vulnerability
Published Jun 10, 2009
·Updated
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.
Affected Software
34 affected components
Safari=1.1
Safari=1.3.1
Safari=3.2.3
Safari=2.0.2
Safari=3.1
Safari=3.1.2
Safari=3.0
Safari=0.8
Safari=2.0
Safari=3.0.4
Safari=0.9
Safari=3.0.3
Safari=1.3.2
Safari=1.2
Safari<=4.0_beta
Safari=3.2.1
Safari=3.0.2
Safari=2.0.4
Safari=3.1.1
Safari=1.0.3
Safari=1.0
Safari=1.3
Safari=3.2
Safari=3.0.1
Safari=3.1.2
Safari<=3.2.3
Safari=3.0.3
Safari=3.0.2
Safari=3.1.1
Safari=3.0
Safari=3.1
Safari=3.2.2
Safari=3.2.1
Safari=3.0.4
Remediation
Patch Available
Patch Available
Event History
Jun 10, 2009
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1681?
CVE-2009-1681 is classified as a medium severity vulnerability.
2
How do I fix CVE-2009-1681?
To mitigate CVE-2009-1681, it is recommended to update to a patched version of Apple Safari.
3
What types of attacks can CVE-2009-1681 facilitate?
CVE-2009-1681 can enable remote attackers to conduct clickjacking attacks.
4
Which versions of Safari are affected by CVE-2009-1681?
CVE-2009-1681 affects Safari versions prior to 4.0, including multiple version numbers from 0.8 to 3.2.3.
5
What is the cause of CVE-2009-1681?
CVE-2009-1681 results from WebKit not properly enforcing the Same Origin Policy in Apple Safari.