PT-2010-2647 · Apple · Safari+1

Published 2010-03-03 · Updated 2010-03-04 · CVE-2010-0924

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apple Safari versions 4.0.3 through 4.0.4

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, by providing a long string in the BACKGROUND attribute of a BODY element. This is related to the cfnetwork.dll component in CFNetwork, used by safari.exe.

Recommendations For Apple Safari versions 4.0.3 through 4.0.4, consider avoiding the use of long strings in the BACKGROUND attribute of BODY elements until a fix is available. As a temporary workaround, restrict the input allowed for the BACKGROUND attribute to prevent potential crashes.

Exploit

Fix

Related Identifiers

CVE-2010-0924

Affected Products

Cfnetwork

Safari

References · 3

• 🔥 http://nobytes.com/exploits/Safari_4.0.4_background_DoS_pl.txt · Exploit
• 🔥 http://securityfocus.com/bid/38447 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0924 · Security Note