CVE-2009-2797: Infoleak
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2797?
The severity of CVE-2009-2797 is classified as moderate, as it allows for potential sensitive information exposure.
How do I fix CVE-2009-2797?
To fix CVE-2009-2797, update to Safari or iPhone OS versions after 3.1 or to iPod touch versions after 3.1.1.
What do the affected versions for CVE-2009-2797 include?
CVE-2009-2797 affects Apple iPhone OS versions before 3.1 and iPod touch versions before 3.1.1, as well as specific Ubuntu Linux versions.
What type of information is vulnerable in CVE-2009-2797?
CVE-2009-2797 can expose usernames and passwords included in URLs sent in Referer headers.
Can CVE-2009-2797 be exploited remotely?
Yes, CVE-2009-2797 can be exploited remotely by attackers accessing Referer logs on affected web servers.