Vulnerability Note VU#905292

Apple Safari code execution vulnerability

Overview

The Apple Safari web browser contains a vulnerability that may allow an attacker to execute arbitrary code.

I. Description

Per Apple Security Update 2007-009:

A memory corruption issue exists in Safari's handling of feed: URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of feed: URLs and providing an error message in case of an invalid URL. This issue does not affect systems running Mac OS X 10.5 or later.

II. Impact

A remote unauthenticated attacker who can persuade a user to click on a malicious hyperlink may be able to execute arbitrary code. Note that per Apple Security Update 2007-009 this vulnerability only affects versions of Safari shipped with Mac OS X 10.4 and earlier.

III. Solution

Update

Apple has released an update to address this issue. See Apple Security Update 2007-009 for more information on obtaining updates.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	18-Dec-2007

References

http://docs.info.apple.com/article.html?artnum=307179

Credit

Information available in About Security Update 2007-009 was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2007-12-18
Date First Published:	2007-12-18
Date Last Updated:	2008-01-07
CERT Advisory:
CVE-ID(s):	CVE-2007-5859
NVD-ID(s):	CVE-2007-5859
US-CERT Technical Alerts:
Metric:	3.85
Document Revision:	12

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader