WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
BID:36995
Info
WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
| Bugtraq ID: | 36995 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3384 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2009 12:00AM |
| Updated: | Apr 16 2015 05:48PM |
| Credit: | Michal Zalewski of Google Inc. <br><br> |
| Vulnerable: |
WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 0 Pardus Linux 2009 0 Apple Safari 4.0.3 for Windows Apple Safari 4.0.2 for Windows Apple Safari 3.2.3 for Windows Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.1 for Windows Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 4 for Windows Apple Safari 3.1 for Windows Apple Safari 3 Beta for Windows Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 |
| Not Vulnerable: |
Apple Safari 4.0.4 for Windows Apple iPod Touch 3.1.3 Apple iPhone 3.1.3 |
Discussion
WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
WebKit is prone to multiple remote code-execution, denial-of-service, and information-disclosure vulnerabilities.
An attacker may exploit these issues by enticing victims into connecting to a malicious FTP server.
Successful exploits can allow attackers to execute arbitrary code in the context of the affected browser, cause denial-of-service conditions, or obtain potentially sensitive information that may aid in other attacks.
WebKit is prone to multiple remote code-execution, denial-of-service, and information-disclosure vulnerabilities.
An attacker may exploit these issues by enticing victims into connecting to a malicious FTP server.
Successful exploits can allow attackers to execute arbitrary code in the context of the affected browser, cause denial-of-service conditions, or obtain potentially sensitive information that may aid in other attacks.
Exploit / POC
WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Apple Safari 4.0.3 for Windows
Solution:
Updates are available. Please see the references for details.
Apple Safari 4.0.3 for Windows
-
Apple APPLE-SA-2009-11-11-1 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2009-11-11-1 SafariSetup.exe
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/
References
WebKit Multiple Remote Code Execution, Denial of Service, and Information Disclosure Vulnerabilities
References:
References:
- Safari Homepage (Apple)