Signature Detail
Short Name |
HTTP:STC:SAFARI:WEBKIT-MENU-MEM |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apple Safari WebKit Menu Onchange Memory Corruption |
Release Date |
2010/12/21 |
Update Number |
1836 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apple Safari WebKit Menu Onchange Memory Corruption
This signature detects attempts to exploit a code execution vulnerability in Apple Safari. It is due to memory corruption when processing the on-change event when applied to Menus. A remote attacker can exploit this by enticing a target user to open a maliciously crafted Web page. In a successful attack the behavior of the target machine depends entirely on the intention of the injected code, which would run within the security context of the logged on user. In an unsuccessful attack, the vulnerable application can terminate abnormally.
Extended Description
Webkit for iPhone and iPod touch is prone to a memory-corruption vulnerability. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. Successfully exploiting these issues may allow attackers to crash the affected device or execute arbitrary code. This issue affects iOS 2.0 through 4.0.2 for iPhone 3G and later and iOS 2.1 through 4.0.2 for iPod touch (2nd generation) and later. NOTE: This issue was previously discussed in BID 43070 (Apple iPhone/iPod touch Prior to iOS 4.1 Multiple Vulnerabilities) but has been given its own record to better document it.
Affected Products
- Apple iOS 2.0
- Apple iOS 3.2
- Apple iOS 3.2.1
- Apple iOS 3.2.2
- Apple iOS 4
- Apple iOS 4.0.1
- Apple iOS 4.0.2
- Apple iOS 4.2 beta
- Apple iPad 3.2
- Apple iPad 3.2.1
- Apple iPad 3.2.2
- Apple iPad
- Apple iPad
- Apple iPhone 2.0
- Apple iPhone 2.0.1
- Apple iPhone 2.0.2
- Apple iPhone 2.1
- Apple iPhone 2.1 - Iphone
- Apple iPhone 2.1 - Ipodtouch
- Apple iPhone 2.2
- Apple iPhone 2.2.1
- Apple iPhone 2.2.1 - Iphone
- Apple iPhone 2.2.1 - Ipodtouch
- Apple iPhone 2.2 - Iphone
- Apple iPhone 2.2 - Ipodtouch
- Apple iPhone 3.0
- Apple iPhone 3.0.1
- Apple iPhone 3.0.1 - Iphone
- Apple iPhone 3.0.1 - Ipodtouch
- Apple iPhone 3.0 - Iphone
- Apple iPhone 3.0 - Ipodtouch
- Apple iPhone 3.1
- Apple iPhone 3.1.2
- Apple iPhone 3.1.2 - Iphone
- Apple iPhone 3.1.2 - Ipodtouch
- Apple iPhone 3.1.3
- Apple iPhone 3.1.3 - Iphone
- Apple iPhone 3.1.3 - Ipodtouch
- Apple iPhone 3.1 - Iphone
- Apple iPhone 3.1 - Ipodtouch
- Apple iPhone 3.2
- Apple iPhone 3.2.1
- Apple iPhone 3.2.1 - Ipad
- Apple iPhone 3.2 - Iphone
- Apple iPhone 3.2 - Ipodtouch
- Apple iPhone 4.0
- Apple iPhone 4.0.1
- Apple iPhone 4.0.1 - Iphone
- Apple iPhone 4.0 - Iphone
- Apple iPhone 4.0 - Ipodtouch
- Apple iPod Touch 2.0
- Apple iPod Touch 2.0.1
- Apple iPod Touch 2.0.2
- Apple iPod Touch 2.1
- Apple iPod Touch 2.2
- Apple iPod Touch 2.2.1
- Apple iPod Touch 3.0
- Apple iPod Touch 3.1.1
- Apple iPod Touch 3.1.2
- Apple iPod Touch 3.1.3
- Apple Safari 4
- Apple Safari 4.0.1
- Apple Safari 4.0.2
- Apple Safari 4.0.2 For Windows
- Apple Safari 4.0.3
- Apple Safari 4.0.3 For Windows
- Apple Safari 4.0.4
- Apple Safari 4.0.4 For Windows
- Apple Safari 4.0.5
- Apple Safari 4.0.5 For Windows
- Apple Safari 4.1
- Apple Safari 4.1.1
- Apple Safari 4.1.2
- Apple Safari 4.1.2 for Windows
- Apple Safari 4 Beta
- Apple Safari 4 For Windows
- Apple Safari 5.0
- Apple Safari 5.0.1
- Apple Safari 5.0.1 for Windows
- Apple Safari 5.0.2
- Apple Safari 5.0.2 for Windows
- Apple Safari 5.0 For Windows
- Mandriva Linux Mandrake 2010.1
- Mandriva Linux Mandrake 2010.1 X86 64
- Red Hat Enterprise Linux Desktop 6
- Red Hat Enterprise Linux Desktop Optional 6
- Red Hat Enterprise Linux HPC Node Optional 6
- Red Hat Enterprise Linux Server 6
- Red Hat Enterprise Linux Server Optional 6
- Red Hat Enterprise Linux Workstation 6
- Red Hat Enterprise Linux Workstation Optional 6
- Red Hat Fedora 12
- Red Hat Fedora 13
- SuSE openSUSE 11.2
- SuSE openSUSE 11.3
- Ubuntu Ubuntu Linux 10.04 Amd64
- Ubuntu Ubuntu Linux 10.04 I386
- Ubuntu Ubuntu Linux 10.04 Powerpc
- Ubuntu Ubuntu Linux 10.04 Sparc
- Ubuntu Ubuntu Linux 10.10 amd64
- Ubuntu Ubuntu Linux 10.10 i386
- Ubuntu Ubuntu Linux 10.10 powerpc
- Ubuntu Ubuntu Linux 9.10 Amd64
- Ubuntu Ubuntu Linux 9.10 I386
- Ubuntu Ubuntu Linux 9.10 Lpia
- Ubuntu Ubuntu Linux 9.10 Powerpc
- Ubuntu Ubuntu Linux 9.10 Sparc
- WebKit Open Source Project WebKit 1.2.2
- WebKit Open Source Project WebKit 1.2.2-1
- WebKit Open Source Project WebKit 1.2.3
- WebKit Open Source Project WebKit
References
- BugTraq: 43083
- CVE: CVE-2010-1814