Signature Detail
Short Name |
HTTP:STC:SAFARI:RTL-USE-FREE |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apple Safari Right-to-Left Text Rendering Use After Free Vulnerability |
Release Date |
2010/10/20 |
Update Number |
1795 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apple Safari Right-to-Left Text Rendering Use After Free Vulnerability
This signature detects attempts to exploit a known memory corruption vulnerability in Apple Safari. It is due to a use-after-free error when handling HTML elements containing right-to-left displayed text. Remote attackers can exploit this to execute arbitrary code on the target machine by enticing a user into opening a specially crafted HTML document. In a successful attack, the behavior of the target machine depends entirely on the intention of the injected code, which runs within the security context of the logged on user. In an unsuccessful attack, the vulnerable application can terminate abnormally.
Extended Description
WebKit is prone to a remote memory-corruption vulnerability; fixes are available. Successful exploits may allow the attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. This issue was previously documented in BID 38671 (Apple Safari Prior to 4.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Affected Products
- Apple iPhone 2.0
- Apple iPhone 2.0.1
- Apple iPhone 2.0.2
- Apple iPhone 2.1
- Apple iPhone 2.2
- Apple iPhone 2.2.1
- Apple iPhone 3.0
- Apple iPhone 3.0.1
- Apple iPhone 3.1
- Apple iPhone 3.1.2
- Apple iPhone 3.1.3
- Apple iPod Touch 2.0
- Apple iPod Touch 2.0.1
- Apple iPod Touch 2.0.2
- Apple iPod Touch 2.1
- Apple iPod Touch 2.2
- Apple iPod Touch 2.2.1
- Apple iPod Touch 3.0
- Apple iPod Touch 3.1.1
- Apple iPod Touch 3.1.2
- Apple iPod Touch 3.1.3
- Apple Safari 4
- Apple Safari 4.0.1
- Apple Safari 4.0.2
- Apple Safari 4.0.2 For Windows
- Apple Safari 4.0.3
- Apple Safari 4.0.3 For Windows
- Apple Safari 4.0.4
- Apple Safari 4.0.4 For Windows
- Apple Safari 4 Beta
- Apple Safari 4 For Windows
- Mandriva Linux Mandrake 2010.1
- Mandriva Linux Mandrake 2010.1 X86 64
- Red Hat Fedora 11
- Red Hat Fedora 12
- Red Hat Fedora 13
- Red Hat Fedora 16
- Ubuntu Ubuntu Linux 10.04 Amd64
- Ubuntu Ubuntu Linux 10.04 I386
- Ubuntu Ubuntu Linux 10.04 Powerpc
- Ubuntu Ubuntu Linux 10.04 Sparc
- Ubuntu Ubuntu Linux 10.10 amd64
- Ubuntu Ubuntu Linux 10.10 i386
- Ubuntu Ubuntu Linux 10.10 powerpc
- Ubuntu Ubuntu Linux 9.10 Amd64
- Ubuntu Ubuntu Linux 9.10 I386
- Ubuntu Ubuntu Linux 9.10 Lpia
- Ubuntu Ubuntu Linux 9.10 Powerpc
- Ubuntu Ubuntu Linux 9.10 Sparc
- WebKit Open Source Project WebKit 1.2.2
- WebKit Open Source Project WebKit 1.2.2-1
- WebKit Open Source Project WebKit 1.2.3
- WebKit Open Source Project WebKit
References
- BugTraq: 38689
- CVE: CVE-2010-0049