SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Apple Safari Vendors:   Apple
Apple Safari Bug in Processing 'feed:' URLs Lets Remote Users Execute Arbitrary JavaScript
SecurityTracker Alert ID:  1022206
SecurityTracker URL:  http://securitytracker.com/id/1022206
CVE Reference:   CVE-2009-0162   (Links to External Site)
Date:  May 13 2009
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 3.2.3
Description:   A vulnerability was reported in Apple Safari. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted 'feed:' URL that, when loaded by the target user, will execute arbitrary JavaScript on the target user's system.

Systems prior to Mac OS X v10.5 are not affected.

Billy Rios and Microsoft Vulnerability Research (MSVR) and Alfredo Melloni reported this vulnerability.

Impact:   A remote user can create a URL that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (3.2.3), available via the Apple Software Update application, or Apple's Safari download site at:

http://www.apple.com/safari/download/

Safari for Mac OS X v10.5.7
The download file is named: Safari3.2.3Leo.dmg
Its SHA-1 digest is: d2e994d0c7125777e396d6c6a056f1222987944e

Safari for Mac OS X v10.4.11
The download file is named: Safari3.2.3Ti.dmg
Its SHA-1 digest is: 3c194ab0f1fa99531f4f1648d34878e9927371af

Safari for Windows XP or Vista
The download file is named: SafariSetup.exe
Its SHA-1 digest is: 54b707e636557720d52526e33262e1a44e8093a6

Safari+QuickTime for Windows XP or Vista
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 215e482adbaa1561ca2b90deb65b397894680f36

The vendor's advisory will be available at:

http://support.apple.com/kb/HT1222

Vendor URL:  apple.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  UNIX (macOS/OS X), Windows (Vista), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  APPLE-SA-2009-05-12 Safari 3.2.3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

APPLE-SA-2009-05-12 Safari 3.2.3

Safari 3.2.3 is now available and addresses the following:

libxml
CVE-ID:  CVE-2008-3529
Available for:  Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  A heap buffer overflow exists in libxml's handling of
long entity names. Visiting a maliciously crafted website may lead to
an unexpected application termination or arbitrary code execution.
This update addresses the issue through improved bounds checking.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Safari 3.2.3
on Mac OS X requires either Mac OS X v10.5.7, or Mac OS X v10.4.11
with Security Update 2009-002 installed.

Safari
CVE-ID:  CVE-2009-0162
Available for:  Mac OS X v10.5.7, Mac OS X Server v10.5.7,
Windows XP or Vista
Impact:  Accessing a maliciously crafted "feed:" URL may lead to
arbitrary code execution
Description:  Multiple input validation issues exist in Safari's
handling of "feed:" URLs. Accessing a maliciously crafted "feed:" URL
may lead to the execution of arbitrary JavaScript. This update
addresses the issues by performing additional validation of "feed:"
URLs. These issues do not affect systems prior to Mac OS X v10.5.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Credit to
Billy Rios and Microsoft Vulnerability Research (MSVR), and Alfredo
Melloni for reporting these issues.

WebKit
CVE-ID:  CVE-2009-0945
Available for:  Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact:  Visiting a maliciously crafted website may lead to arbitrary
code execution
Description:  A memory corruption issue exists in WebKit's handling
of SVGList objects. Visiting a maliciously crafted website may lead
to arbitrary code execution. This update addresses the issue through
improved bounds checking. Safari 3.2.3 is included in the Mac OS X
v10.5.7 update. Safari 3.2.3 on Mac OS X requires either Mac OS X
v10.5.7, or Mac OS X v10.4.11 with Security Update 2009-002
installed. Credit to Nils working with TippingPoint's Zero Day
Initiative for reporting this issue.


Safari 3.2.3 is available via the Apple Software Update application,
or Apple's Safari download site at:
http://www.apple.com/safari/download/

Safari for Mac OS X v10.5.7
The download file is named: Safari3.2.3Leo.dmg
Its SHA-1 digest is: d2e994d0c7125777e396d6c6a056f1222987944e

Safari for Mac OS X v10.4.11
The download file is named: Safari3.2.3Ti.dmg
Its SHA-1 digest is: 3c194ab0f1fa99531f4f1648d34878e9927371af

Safari for Windows XP or Vista
The download file is named: SafariSetup.exe
Its SHA-1 digest is: 54b707e636557720d52526e33262e1a44e8093a6

Safari+QuickTime for Windows XP or Vista
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 215e482adbaa1561ca2b90deb65b397894680f36

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)

iQEcBAEBAgAGBQJKCbCgAAoJEHkodeiKZIkBYIYH/RgKY6f0Gc8uRpwY5WiyOkU9
uPIEBJG9z/JHSQAHFUPQkBt+pX5/glxGJynxcOwgGEqX7nUSHIp4TteuxFAExMwo
9u+JXnhVXjiZv7jGKLUE2KhnuweL/doIC74uYjSguViFASFpBTKAqpV/mqzrEPys
IWsm8HYR5DXSw7d1QipkzormuXSmm0hwl8+tNVMLOqIBaq4nDAUIjHeRKCjHTkd1
Xo1/GMtqcFaFexvtbrKe6Ut/etS8NJPLpetMjNxOw5qZDZiP9MV2EviKRQ2TVXG0
9MIe6rxVDfwLQGAF9rTgtfpqiheojzWcxU0OzqDoJFVDWO5KAvdN8CW6yBpnOVA=
=4rJD
-----END PGP SIGNATURE-----
 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list      (Security-announce@lists.apple.com)
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC