Advisory : Apple Safari remote code execution
| 0 comments ]

Subscribe to the RSS feed in case you are interested in updates

Release mode: ZDI (see previous timelines to know why this went to ZDI)
Ref    : [TZO-37-2009] - Apple Safari Remote code execution (CSS)
Vendor : http://www.apple.com
Status : Patched (http://support.apple.com/kb/HT3613)
Credit : http://support.apple.com/kb/HT3613
CVE    : CVE-2009-1698




Affected products :
  • Apple Safari versions prior to 4.0
Affected systems :
  • Mac OS X v10.4.11, 
  • Mac OS X Server v10.4.11, 
  • Mac OS X v10.5.7, 
  • Mac OS X Server v10.5.7, 
  • Windows XP or Vista

I. Background

Wikipedia quote: "Apple Inc. (NASDAQ: AAPL) is an American multinational corporation which designs and manufactures consumer electronics and software products. The company's best-known hardware products include Macintosh computers, the iPod and the iPhone."

II. Description

Calling the CSS attr attribute with a large number leads to memory corruption

III. Impact

Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution.

IV. Proof of concept

You can build one with above information

V. Disclosure time-line

No time-line available



0 comments

Post a Comment