Apple Safari Search Path Arbitrary Code Execution Vulnerability

Bugtraq ID:	43048
Class:	Input Validation Error
CVE:	CVE-2010-1805
Remote:	Yes
Local:	No
Published:	Sep 07 2010 12:00AM
Updated:	Sep 09 2010 04:22PM
Credit:	Simon Raner of ACROS Security
Vulnerable:	Apple Safari 4.0.5 for Windows Apple Safari 4.0.4 for Windows Apple Safari 4.0.3 for Windows Apple Safari 4.0.2 for Windows Apple Safari 5.0.1 for Windows Apple Safari 5.0 for Windows Apple Safari 4 for Windows
Not Vulnerable:	Apple Safari 4.1.2 for Windows Apple Safari 5.0.2 for Windows

Apple Safari Search Path Arbitrary Code Execution Vulnerability

Apple Safari for Windows is prone to an arbitrary code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the affected application. This may facilitate a compromise of the application and the underlying computer; other attacks are also possible.

Apple Safari Search Path Arbitrary Code Execution Vulnerability

Attackers can exploit this issue with a web browser.

Apple Safari Search Path Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Safari 4 for Windows

• Apple SafariSetup.exe
  APPLE-SA-2009-07-08-1 Safari 4.0.2
  http://www.apple.com/safari/download/

Apple Safari Search Path Arbitrary Code Execution Vulnerability

References:

• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• Safari Homepage (Apple)
  
• ACROS Security: Remote Binary Planting in Apple Safari for Windows (ASPR #2010-0 (ACROS Security Lists )