WebKit MathML Tags Use-After-Free Remote Code Execution Vulnerability

Bugtraq ID:	48824
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-1449
Remote:	Yes
Local:	No
Published:	Jul 20 2011 12:00AM
Updated:	Oct 12 2011 10:30PM
Credit:	wushi of team509.
Vulnerable:	WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r82222 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.X WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Beta Apple Safari 4.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple Safari 0 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 8.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple iTunes 10.2.2 Apple iTunes 10.2 Apple iTunes 10.1 Apple iTunes 10 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4
Not Vulnerable:	Apple Safari 5.0.6 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple iTunes 10.5 Apple iOS 5

WebKit MathML Tags Use-After-Free Remote Code Execution Vulnerability

WebKit is prone to a remote code-execution vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.

Successful attacks will allow attackers to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

NOTE: This issue was previously discussed in 48808 (Apple Safari Prior to 5.1 and 5.0.6 Multiple Security Vulnerabilities) but has been given its own record to better document it.

WebKit MathML Tags Use-After-Free Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WebKit MathML Tags Use-After-Free Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple iTunes 10.2

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes 10.1

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes 10.2.2

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

Apple iTunes 10

• Apple APPLE-SA-2011-10-11-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-10-11-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/

WebKit MathML Tags Use-After-Free Remote Code Execution Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• Webkit Homepage (WebKit)
  
• APPLE-SA-2011-10-11-1 iTunes 10.5 (Apple Product Security )
  
• Multiple Vendor WebKit MathML Use-After-Free Vulnerability (iDefense)