Apple Webkit Attribute Child Removal Remote Code Execution VulnerabilityZDI-10-091: June 8th, 2010
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 9853. For further product information on the TippingPoint IPS:
This vulnerability allows remote attackers to execute remote code on vulnerable installations of Apple Webkit. User interaction is required in that a target must be coerced into visiting a malicious page.
The specific flaw exists within Webkit's process for destructing attribute objects via the removeChild method. If an attribute's child object is accessed after the attribute was removed from the document, an invalid pointer is referenced. This can be exploited by an attacker to execute remote code under the context of the user running the browser.
Vendor ResponseApple has issued an update to correct this vulnerability. More details can be found at:
2010-03-26 - Vulnerability reported to vendor
2010-06-08 - Coordinated public release of advisory
CreditThis vulnerability was discovered by:
Ralf Philipp Weinmann