Google Chrome and Safari WebKit HTML Caption Use After Free Vulnerability
2 Jul. 2010
Summary
Remote exploitation of a memory corruption vulnerability in WebKit, as included with multiple vendors' browsers, could allow an attacker to execute arbitrary code with the privileges of the current user.
Vulnerable Systems:
* Google Chrome 3.0.195.38
* Google Chrome 4.0.249.78
* Safari 4.0.4 on Windows XP
* Safari 4.0.4 on OS X 10.5.8
* Safari prior to versions 4.1 and 5.0
The vulnerability occurs when the a certain property of an HTML element with a caption is reset via JavaScript code. When this occurs, a C++ object is incorrectly accessed after it has been freed. This results in an attacker controlled value being used as a C++ VTABLE, which leads to the execution of arbitrary code.
Patch Availability:
Apple has released a fix which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown. http://www.apple.com/safari/download/
Workaround:
The vulnerability is present in the JavaScript engine, so disabling JavaScript is an effective workaround. This can be performed via the command line with Google Chrome, and the Preferences menu in Safari.
