Remote code execution vulnerability in Apple Mobile Safari for iOS 4.2.1

Release date:
Updated on:

Affected Systems:
Apple MacOS X Server 10.x
Apple iOS
Unaffected system:
Apple MacOS X Server 10.6.7
Apple iOS 4.3.2
Apple iOS 4.2.7
Description:
--------------------------------------------------------------------------------
Bugtraq id: 46832
Cve id: CVE-2011-1417

Safari is the browser in Mac OS X, the latest operating system of Apple Computer. It uses KDE's KHTML as the core of browser computing.

Apple Mobile Safari for iOS 4.2.1 has a remote code execution vulnerability. Remote attackers can exploit this vulnerability to execute arbitrary code in a browser or cause a denial-of-service attack.

This vulnerability is due to support for parsing office files. When processing the OfficeArtMetafileHeader, the process trusts the cbSize field and runs an algorithm on it before the allocation. If no overflow check is performed, the subsequent allocation will be too small. When you copy data to this buffer later, the memory may crash and cause arbitrary code execution.

<* Source: Charlie Miller

Link: http://www.zerodayinitiative.com/advisories/ZDI-11-109/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/