Signature Detail

HTTP: Apple Safari WebKit Rendering Counter Code Execution

This signature detects attempts to exploit a known vulnerability in Apple Safari's WebKit. It is due to an error in WebKit's support for generated content. When utilizing generated content on an element, the vulnerable code inserts multiple references to the generated element. When the generated page is being destroyed, the vulnerable application will navigate through the references to discover more elements to destroy. Remote attackers can exploit this by enticing the target user to open a maliciously crafted Web page. A successful attack can result in execution of arbitrary code within the security context of the current user. An unsuccessful attempt terminates the affected application abnormally.

Extended Description

WebKit is prone to a remote memory-corruption vulnerability. An attacker can exploit this issue by enticing an unsuspecting user into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application. This issue has been addressed in Apple Safari 5.0.1 and 4.1.1. NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Affected Products

• Apple iOS 2.0
• Apple iOS 3.2
• Apple iOS 3.2.1
• Apple iOS 3.2.2
• Apple iOS 4
• Apple iOS 4.0.1
• Apple iOS 4.0.2
• Apple iOS 4.2 beta
• Apple iPad 3.2
• Apple iPad 3.2.1
• Apple iPad 3.2.2
• Apple iPad
• Apple iPad
• Apple iPhone 2.0
• Apple iPhone 2.0.1
• Apple iPhone 2.0.2
• Apple iPhone 2.1
• Apple iPhone 2.2
• Apple iPhone 2.2.1
• Apple iPhone 3.0
• Apple iPhone 3.0.1
• Apple iPhone 3.1
• Apple iPhone 3.1.2
• Apple iPhone 3.1.3
• Apple iPhone 3.2
• Apple iPhone 3.2.1
• Apple iPhone 4.0
• Apple iPhone 4.0.1
• Apple iPod Touch 2.0
• Apple iPod Touch 2.0.1
• Apple iPod Touch 2.0.2
• Apple iPod Touch 2.1
• Apple iPod Touch 2.2
• Apple iPod Touch 2.2.1
• Apple iPod Touch 3.0
• Apple iPod Touch 3.1.1
• Apple iPod Touch 3.1.2
• Apple iPod Touch 3.1.3
• Apple iTunes 9.0.0
• Apple iTunes 9.0.1
• Apple iTunes 9.0.1.8
• Apple iTunes 9.0.2
• Apple iTunes 9.1
• Apple iTunes 9.2
• Apple Safari 4
• Apple Safari 4.0.1
• Apple Safari 4.0.2
• Apple Safari 4.0.2 For Windows
• Apple Safari 4.0.3
• Apple Safari 4.0.3 For Windows
• Apple Safari 4.0.4
• Apple Safari 4.0.4 For Windows
• Apple Safari 4.0.5
• Apple Safari 4.0.5 For Windows
• Apple Safari 4.1
• Apple Safari 4 Beta
• Apple Safari 4 For Windows
• Apple Safari 5.0
• Apple Safari 5.0 For Windows
• Google Chrome 5.0.375.0
• Google Chrome 5.0.375.1
• Google Chrome 5.0.375.10
• Google Chrome 5.0.375.11
• Google Chrome 5.0.375.12
• Google Chrome 5.0.375.13
• Google Chrome 5.0.375.14
• Google Chrome 5.0.375.15
• Google Chrome 5.0.375.16
• Google Chrome 5.0.375.17
• Google Chrome 5.0.375.18
• Google Chrome 5.0.375.19
• Google Chrome 5.0.375.2
• Google Chrome 5.0.375.20
• Google Chrome 5.0.375.21
• Google Chrome 5.0.375.22
• Google Chrome 5.0.375.23
• Google Chrome 5.0.375.25
• Google Chrome 5.0.375.26
• Google Chrome 5.0.375.27
• Google Chrome 5.0.375.28
• Google Chrome 5.0.375.29
• Google Chrome 5.0.375.3
• Google Chrome 5.0.375.30
• Google Chrome 5.0.375.31
• Google Chrome 5.0.375.32
• Google Chrome 5.0.375.33
• Google Chrome 5.0.375.34
• Google Chrome 5.0.375.35
• Google Chrome 5.0.375.36
• Google Chrome 5.0.375.37
• Google Chrome 5.0.375.38
• Google Chrome 5.0.375.39
• Google Chrome 5.0.375.4
• Google Chrome 5.0.375.40
• Google Chrome 5.0.375.41
• Google Chrome 5.0.375.42
• Google Chrome 5.0.375.43
• Google Chrome 5.0.375.44
• Google Chrome 5.0.375.45
• Google Chrome 5.0.375.46
• Google Chrome 5.0.375.47
• Google Chrome 5.0.375.48
• Google Chrome 5.0.375.49
• Google Chrome 5.0.375.5
• Google Chrome 5.0.375.50
• Google Chrome 5.0.375.51
• Google Chrome 5.0.375.52
• Google Chrome 5.0.375.53
• Google Chrome 5.0.375.54
• Google Chrome 5.0.375.55
• Google Chrome 5.0.375.56
• Google Chrome 5.0.375.57
• Google Chrome 5.0.375.58
• Google Chrome 5.0.375.59
• Google Chrome 5.0.375.6
• Google Chrome 5.0.375.60
• Google Chrome 5.0.375.61
• Google Chrome 5.0.375.62
• Google Chrome 5.0.375.63
• Google Chrome 5.0.375.64
• Google Chrome 5.0.375.65
• Google Chrome 5.0.375.66
• Google Chrome 5.0.375.67
• Google Chrome 5.0.375.68
• Google Chrome 5.0.375.69
• Google Chrome 5.0.375.7
• Google Chrome 5.0.375.70
• Google Chrome 5.0.375.71
• Google Chrome 5.0.375.72
• Google Chrome 5.0.375.73
• Google Chrome 5.0.375.74
• Google Chrome 5.0.375.75
• Google Chrome 5.0.375.76
• Google Chrome 5.0.375.77
• Google Chrome 5.0.375.78
• Google Chrome 5.0.375.79
• Google Chrome 5.0.375.8
• Google Chrome 5.0.375.80
• Google Chrome 5.0.375.81
• Google Chrome 5.0.375.82
• Google Chrome 5.0.375.83
• Google Chrome 5.0.375.84
• Google Chrome 5.0.375.85
• Mandriva Linux Mandrake 2010.1
• Mandriva Linux Mandrake 2010.1 X86 64
• Red Hat Enterprise Linux Desktop 6
• Red Hat Enterprise Linux Desktop Optional 6
• Red Hat Enterprise Linux HPC Node Optional 6
• Red Hat Enterprise Linux Server 6
• Red Hat Enterprise Linux Server Optional 6
• Red Hat Enterprise Linux Workstation 6
• Red Hat Enterprise Linux Workstation Optional 6
• Red Hat Fedora 12
• Red Hat Fedora 13
• SuSE openSUSE 11.2
• SuSE openSUSE 11.3
• Ubuntu Ubuntu Linux 10.04 Amd64
• Ubuntu Ubuntu Linux 10.04 I386
• Ubuntu Ubuntu Linux 10.04 Powerpc
• Ubuntu Ubuntu Linux 10.04 Sparc
• Ubuntu Ubuntu Linux 10.10 amd64
• Ubuntu Ubuntu Linux 10.10 i386
• Ubuntu Ubuntu Linux 10.10 powerpc
• Ubuntu Ubuntu Linux 9.10 Amd64
• Ubuntu Ubuntu Linux 9.10 I386
• Ubuntu Ubuntu Linux 9.10 Lpia
• Ubuntu Ubuntu Linux 9.10 Powerpc
• Ubuntu Ubuntu Linux 9.10 Sparc
• WebKit Open Source Project WebKit 1.2.2
• WebKit Open Source Project WebKit 1.2.2-1
• WebKit Open Source Project WebKit 1.2.3
• WebKit Open Source Project WebKit R38566
• WebKit Open Source Project WebKit R51295
• WebKit Open Source Project WebKit R52401
• WebKit Open Source Project WebKit R52833
• WebKit Open Source Project WebKit

References

• BugTraq: 42036
• CVE: CVE-2010-1784