WebKit Style Tag Remote Denial of Service Vulnerability

Bugtraq ID:	38398
Class:	Boundary Condition Error
CVE:	CVE-2010-1029
Remote:	Yes
Local:	No
Published:	Feb 24 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Rad L. Sneak
Vulnerable:	WebKit Open Source Project WebKit 0 Google Chrome 4.0.249 .89 Google Chrome 4.0.249 .78 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Mobile Safari 0 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 + Apple Mac OS X Server 10.4
Not Vulnerable:

WebKit Style Tag Remote Denial of Service Vulnerability

WebKit is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected browser to crash, effectively denying service to legitimate users.

The following are vulnerable:

Apple Safari 4.0.4
Apple Safari for the iPhone and iPod Touch
Google Chrome 4.0.249

Other versions of those browsers or other applications built using WebKit may also be affected.

Note: This BID was originally titled "Apple Safari Style Tag Remote Memory Corruption Vulnerability". Reports indicate that the underlying flaw affects the WebKit library.

Update (March 5, 2010): This issue has been downgraded to a denial-of-service vulnerability. Arbitrary code execution is not possible.

WebKit Style Tag Remote Denial of Service Vulnerability

The following examples are available:

• /data/vulnerabilities/exploits/38398.html
• /data/vulnerabilities/exploits/38398-2.py

WebKit Style Tag Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WebKit Style Tag Remote Denial of Service Vulnerability

References:

• Google Chrome Homepage (Google)
  
• Safari Homepage (Apple)