Recognize-Security

Posted by Trancer on Jun 12 2007

In less then 24 hours since Apple released a Windows version of Safari web browser (v3 Beta), security researches already disclosed some high risk vulnerabilities.
This is the findings so far:

1. Apple Safari for Windows Unspecified Denial of Service Vulnerability by Aviv Raff (Bugtraq ID: 24431).
2. Apple Safari for Windows Memory Corruption Vulnerability by David Maynor (Bugtraq ID: 24433).
3. Apple Safari for Windows URL Protocol Handler Command Injection by Thor Larholm (Bugtraq ID: 24434).
4. Apple Safari for Windows Unspecified SVG Parse Engine Multiple Unspecified Vulnerabilities by Tom Ferris (Bugtraq ID: 24446).
5. Apple Safari for Windows Window.setTimeout Content Spoofing Vulnerability by Robert Swiecki (Bugtraq ID: 24457 – PoC).
6. Apple Safari for Windows “ROWSPAN” Denial of Service (Null Pointer) Vulnerability by Yannick von Arx (Bugtraq ID: 17674 – PoC).
7. Apple Safari Password Manager Cross-Site Information Disclosure Weakness (Reverse Cross-Site Request) by David Teare (Bugtraq ID: 21329 – PoC).
8. Apple Safari for Windows Content and URL Bar Spoofing Vulnerability by Robert Swiecki (Bugtraq ID: 24484 – PoC).
9. Apple Safari for Windows Corefoundation.DLL Denial of Service Vulnerability by Lostmon (Bugtraq ID: 24497 – PoC).
10. Apple Safari for Windows Document.Location Denial of Service Vulnerability by azizov@itdefence.ru (Bugtraq ID: 24499 – PoC).
11. Apple Webkit Invalid Type Conversion Remote Code Execution Vulnerability by Rhys Kidd (Bugtraq ID: 24597).
12. Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability by Richard Moore of Westpoint Ltd (Bugtraq ID: 24598).
13. Apple Safari Cross-Domain Race Condition Information Disclosure Vulnerability by Lawrence Lai, Stan Switzer, Ed Rowe of Adobe Systems (Bugtraq ID: 24599).

Cool ain’t it? Here’s my 2 cents –

Apple Safari for Windows feed:// URI Denial of Service Vulnerability.

(click to enlarge)
Also on:
BID 24460
OSVDB 38864

Stay tuned for more updates.

UPDATE:
SecurityFocus – Flaw hunters go off on Safari

UPDATE 2:
14/06/2007 – Apple has released a new version of Safari for Windows – v3.0.1 Beta, check the security announcement.
There are additional vulnerabilities that has disclosed and reported to Apple, and hasn’t been fixed.

Fixed vulnerabilities:

• Bugtraq ID: 17674
• Bugtraq ID: 24431
• Bugtraq ID: 24433
• Bugtraq ID: 24434
• Bugtraq ID: 24446
• Bugtraq ID: 24457

Unfixed vulnerabilities:

• Bugtraq ID: 21329
• Bugtraq ID: 24460
• Bugtraq ID: 24484
• Bugtraq ID: 24497
• Bugtraq ID: 24499

It’s great that they respond quickly, but what’s the point in releasing a security patch without fixing all vulnerabilities?

UPDATE 3:
22/06/2007 – Apple has released a new version of Safari for Windows – v3.0.2 Beta – security announcement.

Fixed vulnerabilities:

• Bugtraq ID: 24460
• Bugtraq ID: 24484
• Bugtraq ID: 24497
• Bugtraq ID: 24499
• Bugtraq ID: 24597
• Bugtraq ID: 24598
• Bugtraq ID: 24599

Unfixed vulnerabilities:

• Bugtraq ID: 21329

Apple fixed the feed:// URI DoS (NULL pointer deference) vulnerability, found by us. Mentioned in the release notes.
Note that Safari 3.0.2 still vulnerable to the Reverse Cross-Site Request flaw, found by David Teare.

Categories: Vulnerabilities

7 Comments | Comments RSS | TrackBack URL

---