WebKit CSS Counters Remote Memory Corruption Vulnerability
BID:42036
Info
WebKit CSS Counters Remote Memory Corruption Vulnerability
| Bugtraq ID: | 42036 |
| Class: | Unknown |
| CVE: |
CVE-2010-1784 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2010 12:00AM |
| Updated: | Apr 13 2015 09:28PM |
| Credit: | wushi of team509, working with TippingPoint's Zero Day Initiative |
| Vulnerable: |
WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Google Chrome 5.0.375 .70 Google Chrome 5.0.375 .55 Google Chrome 5.0.375.85 Google Chrome 5.0.375.84 Google Chrome 5.0.375.83 Google Chrome 5.0.375.82 Google Chrome 5.0.375.81 Google Chrome 5.0.375.80 Google Chrome 5.0.375.8 Google Chrome 5.0.375.79 Google Chrome 5.0.375.78 Google Chrome 5.0.375.77 Google Chrome 5.0.375.76 Google Chrome 5.0.375.75 Google Chrome 5.0.375.74 Google Chrome 5.0.375.73 Google Chrome 5.0.375.72 Google Chrome 5.0.375.71 Google Chrome 5.0.375.7 Google Chrome 5.0.375.69 Google Chrome 5.0.375.68 Google Chrome 5.0.375.67 Google Chrome 5.0.375.66 Google Chrome 5.0.375.65 Google Chrome 5.0.375.64 Google Chrome 5.0.375.63 Google Chrome 5.0.375.62 Google Chrome 5.0.375.61 Google Chrome 5.0.375.60 Google Chrome 5.0.375.6 Google Chrome 5.0.375.59 Google Chrome 5.0.375.58 Google Chrome 5.0.375.57 Google Chrome 5.0.375.56 Google Chrome 5.0.375.54 Google Chrome 5.0.375.53 Google Chrome 5.0.375.52 Google Chrome 5.0.375.51 Google Chrome 5.0.375.50 Google Chrome 5.0.375.5 Google Chrome 5.0.375.49 Google Chrome 5.0.375.48 Google Chrome 5.0.375.47 Google Chrome 5.0.375.46 Google Chrome 5.0.375.45 Google Chrome 5.0.375.44 Google Chrome 5.0.375.43 Google Chrome 5.0.375.42 Google Chrome 5.0.375.41 Google Chrome 5.0.375.40 Google Chrome 5.0.375.4 Google Chrome 5.0.375.39 Google Chrome 5.0.375.38 Google Chrome 5.0.375.37 Google Chrome 5.0.375.36 Google Chrome 5.0.375.35 Google Chrome 5.0.375.34 Google Chrome 5.0.375.33 Google Chrome 5.0.375.32 Google Chrome 5.0.375.31 Google Chrome 5.0.375.30 Google Chrome 5.0.375.3 Google Chrome 5.0.375.29 Google Chrome 5.0.375.28 Google Chrome 5.0.375.27 Google Chrome 5.0.375.26 Google Chrome 5.0.375.25 Google Chrome 5.0.375.23 Google Chrome 5.0.375.22 Google Chrome 5.0.375.21 Google Chrome 5.0.375.20 Google Chrome 5.0.375.2 Google Chrome 5.0.375.19 Google Chrome 5.0.375.18 Google Chrome 5.0.375.17 Google Chrome 5.0.375.16 Google Chrome 5.0.375.15 Google Chrome 5.0.375.14 Google Chrome 5.0.375.13 Google Chrome 5.0.375.12 Google Chrome 5.0.375.11 Google Chrome 5.0.375.10 Google Chrome 5.0.375.1 Google Chrome 5.0.375.0 Gentoo Linux Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 4.0 Apple iPhone 3.2 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.0 |
| Not Vulnerable: |
WebKit Open Source Project WebKit 1.2.5 Apple Safari 5.0.1 Apple Safari 4.1.1 Apple iTunes 10 Apple iOS 4.2 Apple iOS 4.1 |
Discussion
WebKit CSS Counters Remote Memory Corruption Vulnerability
WebKit is prone to a remote memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
WebKit is prone to a remote memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
WebKit CSS Counters Remote Memory Corruption Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WebKit CSS Counters Remote Memory Corruption Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
Ubuntu Ubuntu Linux 9.10 lpia
Ubuntu Ubuntu Linux 10.04 powerpc
Apple Safari 5.0 for Windows
Ubuntu Ubuntu Linux 9.10 amd64
Ubuntu Ubuntu Linux 10.10 powerpc
Apple iTunes 9.0
Apple iTunes 9.0.1 .8
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_powerpc.deb
Ubuntu Ubuntu Linux 9.10 lpia
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_lpia.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_lpia.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_lpia.deb
Ubuntu Ubuntu Linux 10.04 powerpc
-
Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_powerpc.deb
Apple Safari 5.0 for Windows
-
Apple APPLE-SA-2010-07-28-1
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/
Ubuntu Ubuntu Linux 9.10 amd64
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_amd64.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_amd64.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_amd64.deb
Ubuntu Ubuntu Linux 10.10 powerpc
-
Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.10.1_powerpc.deb
Apple iTunes 9.0
-
Apple iTunes10-iTunes64Setup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10-iTunesSetup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10.dmg
os x
http://www.apple.com/itunes/download/
Apple iTunes 9.0.1 .8
-
Apple iTunes10-iTunes64Setup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10-iTunesSetup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10.dmg
os x
http://www.apple.com/itunes/download/
References
WebKit CSS Counters Remote Memory Corruption Vulnerability
References:
References:
- Apple Safari Homepage (Apple)
- webkit 1.2.5 security update tracking bug (Ubuntu)
- Webkit Homepage (WebKit)
- ZDI-10-144: Apple Webkit Rendering Counter Remote Code Execution Vulnerability (ZDI Disclosures
- ZDI-10-144 Apple Webkit Rendering Counter Remote Code Execution Vulnerability (Zero Day Initiative)
- ZDI-CAN-784: Apple Webkit Rendering Counter Remote Code Execution Vulnerability (Oracle)