Vulnerability Note VU#351217

Apple Safari WebKit component vulnerable to buffer overflow

Overview

Apple Safari WebKit component is vulnerable to buffer overflow. This may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.

I. Description

Safari

Apple Safari is a web browser that comes with the Mac OS X operating system.

WebKit

According to Apple:

WebKit is the open source core of Apple's Safari web browser. It is available as a framework in Mac OS X for use in your applications.

More information is available at the WebKit Project website.

The Problem

The Apple Safari WebKit component contains a heap-based buffer overflow. This vulnerability can be triggered by persuading a user to access a specially crafted web page with Safari.

Considerations

WebKit may be used in other Apple software including, but not limited to Dashboard and Mail.

II. Impact

A remote attacker may be able to execute arbitrary code or crash any application using WebKit

III. Solution

Install an update

This issue is correced in Apple Security Update 2006-001.

Systems Affected

Vendor	Status	Date Updated
Apple Computer, Inc.	Vulnerable	3-Mar-2006
Nokia	Unknown	6-Mar-2006

References

http://security-protocols.com/advisory/sp-x22-advisory.txt
http://secunia.com/advisories/18220/
http://docs.info.apple.com/article.html?artnum=303382
http://secunia.com/advisories/19064/
http://webkit.opendarwin.org/

Credit

This issue was reported in Apple Security Update 2006-001. Apple credits Suresec LTD with reporting this issue.

This document was written by Jeff Gennari

Other Information

Date Public	12/22/2005
Date First Published	03/03/2006 09:23:19 AM
Date Last Updated	03/06/2006
CERT Advisory
CVE Name	CVE-2005-4504
US-CERT Technical Alerts
Metric	17.21
Document Revision	15

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader