Apple Safari KHTMLParser::popOneBlock() code execution
| safari-khtmlparser-code-execution (28081) |  High Risk |
Description:
Apple Safari could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption vulnerability in the KHTMLParser::popOneBlock() function. By creating a malicious Web page containing a script element inside a div object that redefines the document body, a remote attacker could cause a victim's browser to crash or possibly execute arbitrary code on the victim's system, if the victim could be persuaded to visit the malicious site.
Platforms Affected:
- Apple, Safari 2.0.4
Remedy:
For Apple Mac OS X and Mac OS X Server:
Apply Apple Security Update 2006-006 or Mac OS X 10.4.8 Update, available from the Apple Web site. See References.
Consequences:
Gain Access
References:
- Browser Fun Blog, Monday, July 31, 2006, MoBB #31: Safari KHTMLParser::popOneBlock at http://browserfun.blogspot.com/2006/07/mobb-31-safari-khtmlparserpoponeblock.html.
- Mac OS X 10.4.8 and Security Update 2006-006, About the security content of the Mac OS X 10.4.8 Update and Security Update 2006-006 at http://docs.info.apple.com/article.html?artnum=304460.
- US-CERT Technical Cyber Security Alert TA06-275A, Multiple Vulnerabilities in Apple and Adobe Products at http://www.us-cert.gov/cas/techalerts/TA06-275A.html.
- BID-19250: Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability
- CVE-2006-3946: WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a memory management error in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag.
- OSVDB ID: 27534: Apple Safari KHTMLParser::popOneBlock Code Execution
- SA21271: Mac OS X WebKit "KHTMLParser::popOneBlock()" Memory Corruption
- SA22187: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1016957: Mac OS X WebCore WebKit Memory Management Error Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2006-3069: Apple Safari KHTMLParser::popOneBlock() Client-Side Memory Corruption Vulnerability
- VUPEN/ADV-2006-3852: Apple Mac OS X Multiple Command Execution and Denial of Service Vulnerabilities
Reported:
Jul 31, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net