Apple Safari Web Browser Rowspan Denial Of Service Vulnerability

Bugtraq ID:	17674
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2006 12:00AM
Updated:	Apr 24 2006 11:26PM
Credit:	Yannick von Arx is credited with the discovery of this issue.
Vulnerable:	Apple Safari 2.0.3 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9
Not Vulnerable:

Apple Safari Web Browser Rowspan Denial Of Service Vulnerability

Apple Safari web browser is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to consume excessive system resources and eventually crash an affected browser.

Apple Safari Web Browser Rowspan Denial Of Service Vulnerability

The following is suffucient to exploit this issue:

• /data/vulnerabilities/exploits/safari-dos.txt

Apple Safari Web Browser Rowspan Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Apple Safari Web Browser Rowspan Denial Of Service Vulnerability

References:

• MoBB #5: DHTML setAttributeNode() (hdm)
  
• Safari G4 bugreport (yanux.ch)
  
• Safari Homepage (Apple)
  
• Re: Apple Mac OS X Safari 2.0.3 Vulnerability (Colin Keigher)