Signature Detail

HTTP: Apple Safari Webkit Attribute Child Removal Code Execution

This signature detects attempts to exploit a known vulnerability in Apple Safari Webkit. It is due to the way the application handles references to attribute objects and destroys them. Remote attackers can exploit this by enticing the target user to open a maliciously crafted Web page. Successful exploitation can result in execution of arbitrary code within the security context of the current user.

Extended Description

WebKit is prone to a remote code-execution vulnerability in the 'removeChild()' method. An attacker can exploit this issue by enticing an unsuspecting victim into viewing a malicious webpage. Successful exploits may allow the attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously covered in BID 40620 (Apple Safari Prior to 5.0 and 4.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Affected Products

• Apple iPhone 2.0
• Apple iPhone 2.0.1
• Apple iPhone 2.0.2
• Apple iPhone 2.1
• Apple iPhone 2.2
• Apple iPhone 2.2.1
• Apple iPhone 3.0
• Apple iPhone 3.0.1
• Apple iPhone 3.1
• Apple iPhone 3.1.2
• Apple iPhone 3.1.3
• Apple iPod Touch 2.0
• Apple iPod Touch 2.0.1
• Apple iPod Touch 2.0.2
• Apple iPod Touch 2.1
• Apple iPod Touch 2.2
• Apple iPod Touch 2.2.1
• Apple iPod Touch 3.0
• Apple iPod Touch 3.1.1
• Apple iPod Touch 3.1.2
• Apple iPod Touch 3.1.3
• Apple iTunes 8.0
• Apple iTunes 8.0.2.20
• Apple iTunes 8.1
• Apple iTunes 8.2
• Apple iTunes 9.0.0
• Apple iTunes 9.0.1
• Apple iTunes 9.0.1.8
• Apple iTunes 9.0.2
• Apple iTunes 9.1
• Apple Safari 4
• Apple Safari 4.0.1
• Apple Safari 4.0.2
• Apple Safari 4.0.2 For Windows
• Apple Safari 4.0.3
• Apple Safari 4.0.3 For Windows
• Apple Safari 4.0.4
• Apple Safari 4.0.4 For Windows
• Apple Safari 4.0.5
• Apple Safari 4.0.5 For Windows
• Apple Safari 4 Beta
• Apple Safari 4 For Windows
• Open Handset Alliance Android 2.0
• Open Handset Alliance Android 2.0.1
• Open Handset Alliance Android 2.1
• Open Handset Alliance Android 2.1.1
• WebKit Open Source Project WebKit R38566
• WebKit Open Source Project WebKit R51295
• WebKit Open Source Project WebKit R52401
• WebKit Open Source Project WebKit R52833
• WebKit Open Source Project WebKit

References

• BugTraq: 40642
• CVE: CVE-2010-1119
• URL: http://support.apple.com/kb/HT4196