CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.6 | $0-$5k | 0.00 |
A vulnerability was found in Apple Safari 4.0.5 (Web Browser). It has been rated as critical. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is confidentiality, integrity, and availability. CVE summarizes:
Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window s close method, which triggers improper handling of a deleted window object.
The weakness was published 05/07/2010 by Krystian Kloskowski (h07) (Website). The advisory is available at h07.w.interia.pl. The vendor was not involved in the coordination of the public release. This vulnerability is handled as CVE-2010-1939 since 05/13/2010. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available.
A public exploit has been developed by Krystian Kloskowski and been published immediately after the advisory. The exploit is available at coresecurity.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.
Upgrading eliminates this vulnerability. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 10830.
The vulnerability is also documented in the vulnerability database at Exploit-DB (12573). reviews.cnet.com is providing further details. Similar entry is available at VDB-4132.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.3VulDB Meta Temp Score: 6.6
VulDB Base Score: 7.3
VulDB Temp Score: 6.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Author: Krystian Kloskowski
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 902025
OpenVAS Name: Apple Saferi multiple vulnerabilities (Mar10)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Saint ID: exploit_info/safari_parent_close_invalid_pointer
Saint Name: Apple Safari parent.close() Invalid Pointer Code Execution
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Exploit Delay Time: 🔍
TippingPoint: 🔍
McAfee IPS: 🔍
McAfee IPS Version: 🔍
ISS Proventia IPS: 🔍
PaloAlto IPS: 🔍
Fortigate IPS: 🔍
Timeline
05/07/2010 🔍05/07/2010 🔍
05/07/2010 🔍
05/07/2010 🔍
05/08/2010 🔍
05/11/2010 🔍
05/11/2010 🔍
05/13/2010 🔍
05/13/2010 🔍
05/17/2010 🔍
05/19/2010 🔍
02/24/2017 🔍
Sources
Vendor: apple.comAdvisory: h07.w.interia.pl
Researcher: Krystian Kloskowski (h07)
Status: Confirmed
CVE: CVE-2010-1939 (🔍)
OVAL: 🔍
SecurityTracker: 1023958 - Apple Safari Popup Window Memory Corruption Error Lets Remote Users Execute Arbitrary Code
Vulnerability Center: 25780 - Apple Safari Remote Arbitrary Code Execution Vulnerability via a Crafted HTML Document, High
SecurityFocus: 39990 - Apple Safari 'window.parent.close()' Unspecified Remote Code Execution Vulnerability
Secunia: 39670 - Apple Safari Information Disclosure and Code Execution, Highly Critical
OSVDB: 64482 - Apple Safari parent.close() Function Invalid Pointer Arbitrary Code Execution
Vupen: ADV-2010-1097
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
See also: 🔍
Entry
Created: 05/19/2010 02:00Updated: 02/24/2017 15:19
Changes: 05/19/2010 02:00 (89), 02/24/2017 15:19 (12)
Complete: 🔍
Cache ID: 3:C24:103
No comments yet. Languages: en.
Please log in to comment.