PT-2009-4836 · Apple · Webkit+1

Published 2009-07-09 · Updated 2017-08-17 · CVE-2009-2419

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apple Safari versions 4.0 through 4.0.1

Description The issue is related to a use-after-free error in the servePendingRequests() function in WebKit, which can cause a denial of service (application crash) or possibly allow the execution of arbitrary code. This can be triggered by a crafted HTML document referencing a zero-length .js file and utilizing the JavaScript reload function. When a user visits a specially crafted web page, it can lead to a crash due to the dereference of invalid memory. While code execution has not been proven, it cannot be completely ruled out.

Recommendations For Apple Safari versions 4.0 through 4.0.1, consider disabling the servePendingRequests() function as a temporary workaround until a patch is available. Restrict access to specially crafted web pages that could exploit this issue to minimize the risk of browser crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-2419

Affected Products

Safari

Webkit

References · 12

• 🔥 https://exploit-db.com/exploits/33062 · Exploit
• 🔥 http://marcell-dietl.de/index/adv_safari_4_x_js_reload_dos.php · Exploit
• 🔥 http://securityfocus.com/bid/35555 · Exploit
• http://trac.webkit.org/changeset/44519 · Vendor Advisory
• http://secunia.com/advisories/33495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2419 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://osvdb.org/55587 · Note
• http://xforce.iss.net/xforce/xfdb/51533 · Note
• http://secunia.com/advisories/43068 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51533 · Note
• http://vupen.com/english/advisories/2011/0212 · Note