Apple Safari for Windows Document.Location.Hash Buffer Overflow Vulnerability

Bugtraq ID:	26448
Class:	Boundary Condition Error
CVE:	CVE-2007-4812
Remote:	Yes
Local:	No
Published:	Jun 25 2007 12:00AM
Updated:	Nov 15 2007 05:14PM
Credit:	Azizov E. is credited with the discovery of this vulnerability.
Vulnerable:	Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 3 Beta for Windows
Not Vulnerable:	Apple Safari 3.0.4 Beta for Windows

Apple Safari for Windows Document.Location.Hash Buffer Overflow Vulnerability

Safari for Windows is prone to a buffer overflow that occurs when an attacker entices a victim to view a maliciously crafted webpage.

A remote attacker may exploit this issue to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

Apple Safari for Windows Document.Location.Hash Buffer Overflow Vulnerability

The following proof-of-concept code was posted to Bugtraq on September 7, 2007, but testing indicates that it does not correctly trigger the issue.

• /data/vulnerabilities/exploits/26448.html

Apple Safari for Windows Document.Location.Hash Buffer Overflow Vulnerability

Solution:
Apple released security advisory APPLE-SA-2007-11-14 to address this issue. Please see the references for more information.

Apple Safari for Windows Document.Location.Hash Buffer Overflow Vulnerability

References:

• Safari 3 Download Page (Apple)
  
• Safari Homepage (Apple)
  
• Safari 3.0.3 (522.15.5) Buffer overflow ([email protected] )