Safari for windows 5.1.7 (7534.57.2) Remote code execution
JavaScriptCore.dll (7534.57.3.3)
Vendor notify: NO Exploit available: Private
Advisore:http://lostmon.blogspot.com.es/2013/12/safari-for-windows-517-7534572-remote.html
#############################################
Safari for windows is a discontinued product; but in my work ) tecnical support for clients and bussines) i found it installed in serveral machines.
Iit is prone vulnerable to a buffer overflow in JavaScriptCore.dll that allows remote crash if failed or Remote Code Execution if the exploit is succesfully.
This issue is tiggered when safari try to allocate a large amount of data in javascript stack memory.
We espect a " out of memory" alert box, but we can bypass or fuzzing this alert and result a RCE.
i don't like the responses from Apple amd this is a discontinued product.... See Windbg Log for this issue:
(1240.1334): Access violation - code c0000005 (!!! second chance !!!) eax=00000000 ebx=00000000 ecx=77d25085 edx=00000000 esi=1d7c0000 edi=7ff90240 eip=61b39357 esp=0023f01c ebp=00000001 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Safari\Apple Application Support\JavaScriptCore.dll - JavaScriptCore!WTF::fastMalloc+0x157: 61b39357 c705efbeadbb00000000 mov dword ptr ds:[0BBADBEEFh],0 ds:0023:bbadbeef=???????? 0:000> !load msec.dll 0:000> !exploitable -m VERSION:1.6.0.0 IDENTITY:HostMachine\HostUser PROCESSOR:X86 CLASS:USER QUALIFIER:USER_PROCESS EVENT:DEBUG_EVENT_EXCEPTION EXCEPTION_FAULTING_ADDRESS:0xffffffffbbadbeef EXCEPTION_CODE:0xC0000005 EXCEPTION_LEVEL:SECOND_CHANCE EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION EXCEPTION_SUBTYPE:WRITE FAULTING_INSTRUCTION:61b39357 mov dword ptr ds:[0bbadbeefh],0 MAJOR_HASH:0x7fdedd27 MINOR_HASH:0x39b7b969 STACK_DEPTH:6 STACK_FRAME:JavaScriptCore!WTF::fastMalloc+0x157 STACK_FRAME:WebKit!WKDictionaryGetTypeID+0xb112 STACK_FRAME:WebKit!WKCredentialGetTypeID+0x1f776 STACK_FRAME:WebKit!WKCredentialGetTypeID+0x489f2 STACK_FRAME:WebKit!WKCredentialGetTypeID+0x4337e STACK_FRAME:JavaScriptCore!JSC::JSArray::getOwnPropertySlotByIndex+0x2a44 INSTRUCTION_ADDRESS:0x0000000061b39357 INVOKING_STACK_FRAME:0 DESCRIPTION:User Mode Write AV SHORT_DESCRIPTION:WriteAV CLASSIFICATION:EXPLOITABLE BUG_TITLE:Exploitable - User Mode Write AV starting at JavaScriptCore!WTF::fastMalloc+0x0000000000000157 (Hash=0x7fdedd27.0x39b7b969) EXPLANATION:User mode write access violations that are not near NULL are exploitable.0:000> !exploitable !exploitable 1.6.0.0 Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode Write AV starting at JavaScriptCore!WTF::fastMalloc+0x0000000000000157 (Hash=0x7fdedd27.0x39b7b969) User mode write access violations that are not near NULL are exploitable.####################### €nd ##########################
--
atentamente: Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
-- La curiosidad es lo que hace mover la mente....
Posts
