Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability

Bugtraq ID:	50163
Class:	Input Validation Error
CVE:	CVE-2011-3229
Remote:	Yes
Local:	No
Published:	Oct 17 2011 12:00AM
Updated:	Oct 17 2011 12:00AM
Credit:	Aaron Sigel of vtty.com
Vulnerable:	Apple Safari 5.0.6 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4
Not Vulnerable:	Apple Safari 5.1.1 for Windows Apple Safari 5.1.1

Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability

Apple Safari is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows attackers to execute arbitrary script code which results in access of local files in the context of the installed safari extensions; this may aid in other attacks.

NOTE: This issue was previously covered in BID 50089 (Apple Safari Prior to 5.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability

An exploit and a video demonstrating it has been published by the reporter. Please see the references for details.

Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Safari 5.1

• Apple Safari5.1.1Lion.dmg
  Safari for OS X Lion v10.7.2
  http://www.apple.com/safari/download/


• Apple Safari5.1.1SnowLeopard.dmg
  Safari for Mac OS X v10.6.8
  http://www.apple.com/safari/download/

Apple Safari 5.1 for Windows

• Apple APPLE-SA-2011-10-12-4 Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-10-12-4 SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-10-12-4 SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

Apple Safari 'safari-extension://' URL Handling Directory Traversal Vulnerability

References:

• CVE-2011-3229 - Steal files and inject js in Safari Extensions (Aaron Sigel of vtty.com)
  
• Safari Homepage (Apple)
  
• Walkthrough of Safari Extension PoC (Aaron Sigel of vtty.com)