CVE-2009-1699 XML external entity in n/a
Remote attackers can read arbitrary files via crafted DTDs in WebKit's XSL stylesheet implementation, affecting Safari and iOS users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-1699?
CVE-2009-1699 is a high-severity vulnerability in Apple Iphone Os, published on 10 Jun 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Weakness: CWE-611
Which versions are affected by CVE-2009-1699?
It affects 4 products.
Products include Apple Iphone Os, Apple Safari, Canonical Ubuntu Linux, Opensuse Opensuse.
How do I fix CVE-2009-1699?
Upgrade to a fixed version.
Is CVE-2009-1699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1699 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as GHSA-q425-6m5x-qp5p.