var-200908-0264
Vulnerability from variot
Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users. Apple GarageBand is prone to an information-disclosure vulnerability. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in tracking a user's web activities. This issue affects versions prior to GarageBand 5.1 for Mac OS X 10.5.7. Apple GarageBand is a set of music production software from Apple (Apple). ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
For more information visit: http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com
TITLE: Apple GarageBand Web Activity Tracking Disclosure
SECUNIA ADVISORY ID: SA36114
VERIFY ADVISORY: http://secunia.com/advisories/36114/
DESCRIPTION: A security issue has been reported in GarageBand, which can be exploited by malicious people to gain knowledge of sensitive information.
The problem is caused due to Safari's preferences being changed to always accept cookies when opening GarageBand. This could allow third parties and advertisers to track a user's web activity.
SOLUTION: Update to version 5.1. http://support.apple.com/downloads/GarageBand_5_1
NOTE: Users of previous versions should also check that their Safari preferences are set as desired.
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: http://support.apple.com/kb/HT3732
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200908-0264",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "garageband",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "4.1.2"
},
{
"model": "garageband",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "garageband",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "5.0"
},
{
"model": "garageband",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "4.1.1"
},
{
"model": "garageband",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "5.0.2"
},
{
"model": "garageband",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "5.0.2"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.7"
},
{
"model": "garageband",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
}
],
"sources": [
{
"db": "BID",
"id": "35926"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
}
],
"trust": 0.6
},
"cve": "CVE-2009-2198",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2009-2198",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-39644",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2009-2198",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2009-2198",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200908-506",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-39644",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users. Apple GarageBand is prone to an information-disclosure vulnerability. \nExploiting the issue may allow an attacker to obtain sensitive information that could aid in tracking a user\u0027s web activities. \nThis issue affects versions prior to GarageBand 5.1 for Mac OS X 10.5.7. Apple GarageBand is a set of music production software from Apple (Apple). ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nApple GarageBand Web Activity Tracking Disclosure\n\nSECUNIA ADVISORY ID:\nSA36114\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/36114/\n\nDESCRIPTION:\nA security issue has been reported in GarageBand, which can be\nexploited by malicious people to gain knowledge of sensitive\ninformation. \n\nThe problem is caused due to Safari\u0027s preferences being changed to\nalways accept cookies when opening GarageBand. This could allow third\nparties and advertisers to track a user\u0027s web activity. \n\nSOLUTION:\nUpdate to version 5.1. \nhttp://support.apple.com/downloads/GarageBand_5_1\n\nNOTE: Users of previous versions should also check that their Safari\npreferences are set as desired. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nhttp://support.apple.com/kb/HT3732\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-2198"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "BID",
"id": "35926"
},
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "PACKETSTORM",
"id": "79912"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-2198",
"trust": 2.8
},
{
"db": "BID",
"id": "35926",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "36114",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1022649",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2009-2141",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "56738",
"trust": 2.5
},
{
"db": "XF",
"id": "52248",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506",
"trust": 0.7
},
{
"db": "APPLE",
"id": "APPLE-SA-2009-08-03-1",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-39644",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "79912",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "BID",
"id": "35926"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "PACKETSTORM",
"id": "79912"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"id": "VAR-200908-0264",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-39644"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:27:52.292000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT3732",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3732"
},
{
"title": "HT3732",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3732?viewlocale=ja_JP"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/35926"
},
{
"trust": 2.5,
"url": "http://osvdb.org/56738"
},
{
"trust": 2.5,
"url": "http://www.securitytracker.com/id?1022649"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/36114"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2009/2141"
},
{
"trust": 1.8,
"url": "http://support.apple.com/kb/ht3732"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2009/aug/msg00000.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/52248"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52248"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-2198"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-2198"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ilife/garageband/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/garageband_5_1"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/36114/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "BID",
"id": "35926"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "PACKETSTORM",
"id": "79912"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-39644"
},
{
"db": "BID",
"id": "35926"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"db": "PACKETSTORM",
"id": "79912"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-39644"
},
{
"date": "2009-08-03T00:00:00",
"db": "BID",
"id": "35926"
},
{
"date": "2009-09-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"date": "2009-08-05T08:42:40",
"db": "PACKETSTORM",
"id": "79912"
},
{
"date": "2009-08-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"date": "2009-08-04T16:30:00.327000",
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-17T00:00:00",
"db": "VULHUB",
"id": "VHN-39644"
},
{
"date": "2009-08-27T22:22:00",
"db": "BID",
"id": "35926"
},
{
"date": "2009-09-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001971"
},
{
"date": "2009-08-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200908-506"
},
{
"date": "2024-11-21T01:04:21.900000",
"db": "NVD",
"id": "CVE-2009-2198"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple GarageBand Information Disclosure Vulnerability",
"sources": [
{
"db": "BID",
"id": "35926"
},
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200908-506"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…