WebKit Style Handling Memory Corruption Vulnerability

Bugtraq ID:	46849
Class:	Unknown
CVE:	CVE-2011-1290
Remote:	Yes
Local:	No
Published:	Mar 10 2011 12:00AM
Updated:	Oct 11 2011 07:10PM
Credit:	Vincenzo Iozzo, Ralf Philipp Weinmann and Willem Pinckaers
Vulnerable:	Research In Motion Blackberry Torch 9800 0 Research In Motion Blackberry Style 9670 0 Research In Motion Blackberry Pearl 9100 0 Research In Motion Blackberry Pearl 8100 0 Research In Motion Blackberry Device Software 6.0 Research In Motion Blackberry Curve 9300 0 Research In Motion Blackberry Curve 8300 0 Research In Motion Blackberry Browser 0 Research In Motion BlackBerry 9780 0 Research In Motion Blackberry 9700 5.0.0.593 Research In Motion Blackberry 8800 4.2 Research In Motion Blackberry 8800 4.1 Research In Motion Blackberry 8800 0 Research In Motion Blackberry 8720 4.2 Research In Motion Blackberry 8720 4.1 Research In Motion Blackberry 8700r Research In Motion Blackberry 8700f Research In Motion Blackberry 8700c Research In Motion Blackberry 8320 4.2 Research In Motion Blackberry 8320 4.1 Research In Motion Blackberry 7780 Research In Motion Blackberry 7750 Research In Motion Blackberry 7730 Research In Motion Blackberry 7520 Research In Motion Blackberry 7290 Research In Motion Blackberry 7280 Research In Motion BlackBerry 7270 0 Research In Motion Blackberry 7250 Research In Motion Blackberry 7230 4.0 Research In Motion Blackberry 7230 3.8 Research In Motion Blackberry 7230 3.7.1 .41 Research In Motion Blackberry 7130e Research In Motion Blackberry 7105t Research In Motion Blackberry 7100x Research In Motion Blackberry 7100v Research In Motion Blackberry 7100t Research In Motion Blackberry 7100r Research In Motion Blackberry 7100i Research In Motion Blackberry 7100g Research In Motion BlackBerry 9700 Research In Motion BlackBerry 9650 Research In Motion BlackBerry 8530 Research In Motion BlackBerry 8520 Research In Motion BlackBerry 8330 Google Chrome 9.0.597.94 Google Chrome 9.0.597.84 Google Chrome 9.0.597.107 Google Chrome 10.0.648.128 Google Chrome 10.0.648.127 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Beta Apple Safari 4.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iTunes 10.2 Apple iTunes 10.1 Apple iTunes 10 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.0
Not Vulnerable:	Google Chrome 10.0.648.133 Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple iTunes 10.2.2 Apple iOS 4.3.2 Apple iOS 4.2.7

WebKit Style Handling Memory Corruption Vulnerability

WebKit is prone to a memory-corruption vulnerability.

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious webpage.

Successful exploits will allow attackers to execute arbitrary code in the context of the browser. Failed exploit attempts will result in a denial-of-service condition.

NOTE: This issue was previously discussed in BID 46833 (Blackberry Browser Multiple Unspecified Information Disclosure and Integer Overflow Vulnerabilities), but has been given its own record to better document it.

WebKit Style Handling Memory Corruption Vulnerability

This issue was successfully exploited at CanSecWest's 2011 Pwn2Own contest on a Blackberry device. The exploit is not known to be public or in the wild.

NOTE: To exploit this issue through iTunes, an attacker must first execute a successful man-in-the-middle attack.

WebKit Style Handling Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Safari 5.0.4 for Windows

• Apple APPLE-SA-2011-04-14-3 Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-04-14-3 SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-04-14-3 SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

WebKit Style Handling Memory Corruption Vulnerability

References:

• (Pwn2Own) Webkit CSS Text Element Count Remote Code Execution Vulnerability (Zero Day Initiaitve )
  
• Google Chrome 10.0.648.133 has been released for Windows, Mac, Linux and Chrome (Google)
  
• Google Chrome Homepage (Google)
  
• iPhone, BlackBerry Fall on Second Day of Pwn2Own (Dennis Fisher)
  
• Research In Motion Homepage (Research In Motion)
  
• Webkit Homepage (WebKit)
  
• APPLE-SA-2011-04-18-1 iTunes 10.2.2 (Apple)
  
• Vulnerabilities in WebKit browser engine impact BlackBerry 6 (Research In Motion)
  
• Vulnerability in WebKit browser engine impacts BlackBerry Device Software versio (Research In Motion)