Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability

Bugtraq ID:	19250
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 29 2006 12:00AM
Updated:	Sep 29 2006 10:10PM
Credit:	hdm is credited with the discovery of this vulnerability.
Vulnerable:	Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Mobile Safari 0 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 + Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3
Not Vulnerable:

Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability

Safari is prone to a buffer-overflow vulnerability. This issue is triggered when an attacker entices a victim user to visit a malicious website or to open a malicious HTML file.

A remote attacker may exploit this issue to execute arbitrary machine code in the context of the affected application. Failed exploit attempts result in crashing the application, effectively denying service to legitimate users.

Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/safari-jul31-2006.html

Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability

Solution:
Apple has released Apple Mac OS X 10.4.8 to address this issue. Please see the referenced advisory for more information.


Apple Mac OS X Server 10.3.9

• Apple SecUpdSrvr2006-006Pan.dmg
  Security Update 2006-006 (10.3.9 Server)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11770&cat= 1&platform=osx&method=sa/SecUpdSrvr2006-006Pan.dmg

Apple Mac OS X 10.3.9

• Apple SecUpd2006-006Pan.dmg
  Security Update 2006-006 (10.3.9 Client)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11769&cat= 1&platform=osx&method=sa/SecUpd2006-006Pan.dmg

Apple Mac OS X 10.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.1

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.1

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.2

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.2

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.3

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.3

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X Server 10.4.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X Server 10.4.5

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X 10.4.5

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X Server 10.4.6

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X 10.4.6

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X 10.4.7

• Apple MacOSXUpd10.4.8Intel.dmg
  Mac OS X 10.4.8 Update (Intel)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11796&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8Intel.dmg


• Apple MacOSXUpd10.4.8PPC.dmg
  Mac OS X 10.4.8 Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11794&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8PPC.dmg


• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.7

• Apple MacOSXUpd10.4.8Intel.dmg
  Mac OS X 10.4.8 Update (Intel)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11796&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8Intel.dmg


• Apple MacOSXUpd10.4.8PPC.dmg
  Mac OS X 10.4.8 Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11794&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8PPC.dmg


• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048updateppc.html


• Apple Mac OS X Server 10.4.8 Update (Universal)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048updateuniversal .html

Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability

References:

• MoBB #31: Safari KHTMLParser::popOneBlock (hdm)
  
• Safari Homepage (Apple)