Apple Safari KHTMLParser::popOneBlock() code execution
| safari-khtmlparser-code-execution (28081) |  High Risk |
Description:
Apple Safari could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption vulnerability in the KHTMLParser::popOneBlock() function. By creating a malicious Web page containing a script element inside a div object that redefines the document body, a remote attacker could cause a victim's browser to crash or possibly execute arbitrary code on the victim's system, if the victim could be persuaded to visit the malicious site.
*CVSS:
| Base Score: | 5.6 |
| Access Vector: | Remote |
| Access Complexity: | High |
| Authentication: | Not Required |
| Confidentiality Impact: | Partial |
| Integrity Impact: | Partial |
| Availability Impact: | Partial |
| Temporal Score: | 4.4 |
| Exploitability: | Proof-Of-Concept |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Gain Access
Remedy:
For Apple Mac OS X and Mac OS X Server:
Apply Apple Security Update 2006-006 or Mac OS X 10.4.8 Update, available from the Apple Web site. See References.
References:
- Browser Fun Blog, Monday, July 31, 2006: MoBB #31: Safari KHTMLParser::popOneBlock .
- Mac OS X 10.4.8 and Security Update 2006-006: About the security content of the Mac OS X 10.4.8 Update and Security Update 2006-006.
- US-CERT Technical Cyber Security Alert TA06-275A: Multiple Vulnerabilities in Apple and Adobe Products.
- BID-19250: Apple Safari KHTMLParser::popOneBlock Buffer Overflow Vulnerability
- CVE-2006-3946: WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a memory management error in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag.
- OSVDB ID: 27534: Apple Safari KHTMLParser::popOneBlock Code Execution
- SA21271: Mac OS X WebKit "KHTMLParser::popOneBlock()" Memory Corruption
- SA22187: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1016957: Mac OS X WebCore WebKit Memory Management Error Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2006-3069: Apple Safari KHTMLParser::popOneBlock() Client-Side Memory Corruption Vulnerability
- VUPEN/ADV-2006-3852: Apple Mac OS X Multiple Command Execution and Denial of Service Vulnerabilities
Platforms Affected:
- Apple Safari 2.0.4
Reported:
Jul 31, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.