Advisory Details

July 25th, 2008

Apple Safari StyleSheet ownerNode Heap Corruption Vulnerability

ZDI-08-045
ZDI-CAN-332

CVE ID CVE-2008-2317
CVSS SCORE
AFFECTED VENDORS Apple
AFFECTED PRODUCTS Safari
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['6146']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.

The specific flaw exists in the garbage collection of JavaScript document elements in WebCore. When a CSSStyleSheet object of a style element is copied, and the style element is deallocated, a reference to the ownerNode property of the copied CSSStyleSheet object will result in a heap corruption allowing for the execution of arbitrary code.

ADDITIONAL DETAILS Apple has issued an update to correct this vulnerability. More details can be found at:
http://support.apple.com/kb/HT2351
DISCLOSURE TIMELINE
  • 2008-05-13 - Vulnerability reported to vendor
  • 2008-07-25 - Coordinated public release of advisory
CREDIT Anonymous
BACK TO ADVISORIES