Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:23998
HistoryJun 08, 2010 - 12:00 a.m.

VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free Vulnerability (CVE-2010-1392)

2010-06-0800:00:00
vulners.com
8

VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free
Vulnerability (CVE-2010-1392)

http://www.vupen.com/english/research.php

I. BACKGROUND

"Safari is a web browser developed by Apple. As of February 2010,
Safari was the fourth most widely used browser, with 4.45% of the
worldwide usage share of web browsers according to Net Application."

II. DESCRIPTION

VUPEN Vulnerability Research Team discovered a vulnerability in
Apple Safari for Windows, Mac OS X and iPhone.

The flaw is caused due to a use-after-free error in WebKit when
rendering HTML buttons, which could be exploited by attackers to
execute arbitrary code via a specially crafted web page.

III. AFFECTED PRODUCTS

Apple Safari version 4.0.5 and prior

(Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8,
Mac OS X Server v10.5.8, Mac OS X v10.6.2 or later, Mac OS X Server
v10.6.2 and later, Windows 7, Vista, XP SP2 and later, iPhone)

IV. Binary Analysis & Proof-of-concept

In-depth binary analysis of the vulnerability and a code execution exploit
have been published by VUPEN through the VUPEN Binary Analysis & Exploits
portal :

http://www.vupen.com/exploits/

V. SOLUTION

Upgrade to Apple Safari version 5.0 or 4.1 :
http://www.apple.com/safari/download/

VI. CREDIT

The vulnerability was discovered by Matthieu Bonetti of VUPEN Security

VII. ABOUT VUPEN Security

VUPEN is a leading IT security research company providing vulnerability
management and security intelligence solutions which enable enterprises
and institutions to eliminate vulnerabilities before they can be exploited,
ensure security policy compliance and meaningfully measure and manage risks.

Governmental and federal agencies, and global enterprises in the financial
services, insurance, manufacturing and technology industries rely on VUPEN
to improve their security, prioritize resources, cut time and costs, and
stay ahead of the latest threats.

VIII. REFERENCES

http://www.vupen.com/english/advisories/2010/1373
http://support.apple.com/kb/HT4196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1392

IX. DISCLOSURE TIMELINE

2010-03-30 - Vendor notified
2010-03-30 - Vendor response
2010-05-07 - Status update received
2010-06-02 - Status update received
2010-06-08 - Coordinated public Disclosure

Related for SECURITYVULNS:DOC:23998