Apple Safari for Windows Document.Location Denial of Service Vulnerability
TITLE: Apple Safari for Windows Document.Location Denial of Service Vulnerability
CLASS: Input Validation Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 16 2007 12:00AM
UPDATE: Jun 18 2007 05:19PM
CREDIT: azizov@itdefence.ru is credited with discovering this vulnerability.
VULNERABLE:
Apple Safari 3.0.1 Beta for WindowsNOT VULNERABLE:
Apple Safari 3 Beta for Windows
Vai alla pagina originale su Security Focus
Discussion
Apple Safari for Windows is prone to a denial-of-service vulnerability because it fails to properly handle user-supplied input.
An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.
Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.
Safari 3.0 and 3.0.1 public beta for Windows are reported vulnerable.
NOTE: At the time of writing, Symantec was unable to reproduce this vulnerability. We are investigating this issue further and will update this BID as more information emerges.
Exploit
An attacker may exploit this issue by enticing victims into viewing a maliciously crafted webpage.
The following proof of concept is available:
Solution
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.
References
References:
- Safari Homepage (Apple)
- Local Denial of Service in Safari (azizov@itdefence.ru)