Apple Safari contains a Javascript flaw that may allow an attacker to open a dialog box in front of a window displaying a trusted web site. This can allow them to make it appear that the dialog box comes from the trusted web site, which may be used to trick users into entering passwords or other sensitive information.

OSVDB is not aware of a solution for this vulnerability.

• Security Tracker: 1014259
• Related OSVDB ID: 17397 79191 79192 79194 79195 79196 79197 79198 79199 79200 79201 79202 79203 79204 79205 79206 79207 79208 79209 79210 79211 79212 79213
• Secunia Advisory ID: 15474
• CVE ID: 2005-2272 (see also: NVD)
• Generic Exploit URL: http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/
• Other Advisory URL: http://secunia.com/secunia_research/2005-12/advisory/
  http://www.microsoft.com/technet/security/advisory/902333.mspx
  http://www.us-cert.gov/cas/bulletins/SB05-173.html
• Generic Informational URL: http://www.eweek.com/article2/0,1759,1830025,00.asp

• Jakob Balle - Secunia Research