Description
Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and CVE-2004-0867.
References
- ADV-2008-3444 vdb-entry
- TA08-350A third-party-advisory
- 30192 vdb-entry
- 31128 third-party-advisory
- http://support.apple.com/kb/HT3338
- safari-domains-session-hijacking(43839) vdb-entry
- APPLE-SA-2008-12-15 vendor-advisory
- http://kuza55.blogspot.com/2008/07/some-random-safari-notes.html
- 1020539 vdb-entry