Apple Safari for Windows Corefoundation.DLL Denial of Service Vulnerability

TITLE: Apple Safari for Windows Corefoundation.DLL Denial of Service Vulnerability
CLASS: Input Validation Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 16 2007 12:00AM
UPDATE: Jun 18 2007 04:59PM
CREDIT: Lostmon is credited with discovering this vulnerability.
VULNERABLE:

Apple Safari 3.0.1 Beta for Windows
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Apple Safari for Windows is prone to a denial-of-service vulnerability because it fails to properly handle user-supplied input.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions. Attackers may also be able to execute arbitrary code, but Symantec had not confirmed this.

Safari 3.0.1 public beta for Windows is reported vulnerable.

Exploit

An attacker may exploit this issue by enticing victims into viewing a maliciously crafted webpage.

The following proof of concept is available:

Solution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.

References

References:

PhpLog

BNLug Benevento Linux Users Group