CVE ID:	CVE-2009-1697
Description:	CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header.
Test IDs:	1.3.6.1.4.1.25623.1.1.1.1.2009.1950
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1697 http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html BugTraq ID: 35260 http://www.securityfocus.com/bid/35260 Debian Security Information: DSA-1950 (Google Search) http://www.debian.org/security/2009/dsa-1950 http://osvdb.org/54992 http://securitytracker.com/id?1022344 http://secunia.com/advisories/35379 http://secunia.com/advisories/37746 http://secunia.com/advisories/43068 SuSE Security Announcement: SUSE-SR:2011:002 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://www.vupen.com/english/advisories/2009/1522 http://www.vupen.com/english/advisories/2009/1621 http://www.vupen.com/english/advisories/2011/0212