ID CVE-2010-0040
Summary Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.
References
Vulnerable Configurations
  • Apple Safari 4.0.4
    cpe:2.3:a:apple:safari:4.0.4
  • Apple Safari 4.0.3
    cpe:2.3:a:apple:safari:4.0.3
  • Apple Safari 4.0.2
    cpe:2.3:a:apple:safari:4.0.2
  • Apple Safari 4.0.1
    cpe:2.3:a:apple:safari:4.0.1
  • Apple Safari 4.0.0b
    cpe:2.3:a:apple:safari:4.0.0b
  • Apple Safari 4.0
    cpe:2.3:a:apple:safari:4.0
  • Microsoft Windows
    cpe:2.3:o:microsoft:windows
CVSS
Base: 9.3 (as of 15-03-2010 - 10:29)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Windows
    NASL id ITUNES_9_1.NASL
    description The version of Apple iTunes installed on the remote Windows host is older than 9.1. Such versions may be affected by multiple vulnerabilities : - A buffer underflow in ImageIO's handling of TIFF images may lead to an application crash or arbitrary code execution. (CVE-2009-2285) - An integer overflow in the applications's handling of images with an embedded color profile may lead to an application crash or arbitrary code execution. (CVE-2010-0040) - An uninitialized memory access issue in ImageIO's handling of BMP images may result in sending data from Safari's memory to a website under an attacker's control. (CVE-2010-0041) - An uninitialized memory access issue in ImageIO's handling of TIFF images may result in sending data from Safari's memory to a website under an attacker's control. (CVE-2010-0042) - A memory corruption issue in the application's handling of TIFF images may lead to an application crash or arbitrary code execution. (CVE-2010-0043) - A race condition during the installation process may allow a local user modify a file that is then executed with SYSTEM privileges. (CVE-2010-0532) - A path searching issue may allow code execution if an attacker can place a specially crafted DLL in a directory and have a user open another file using iTunes in that directory. (CVE-2010-1795)
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 45390
    published 2010-03-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45390
    title Apple iTunes < 9.1 Multiple Vulnerabilities (credentialed check)
  • NASL family Windows
    NASL id SAFARI_4_0_5.NASL
    description The version of Safari installed on the remote Windows host is earlier than 4.0.5. It thus is potentially affected by several issues : - A buffer underflow in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2009-2285) - An integer overflow in the handling of images with an embedded color profile could lead to a crash or arbitrary code execution. (CVE-2010-0040) - An uninitialized memory access issue in ImageIO's handling of BMP images could result in sending of data from Safari's memory to a website. (CVE-2010-0041) - An uninitialized memory access issue in ImageIO's handling of TIFF images could result in the sending of data from Safari's memory to a website. (CVE-2010-0042) - A memory corruption issue in the handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2010-0043) - An implementation issue in the handling of cookies set by RSS and Atom feeds could result in a cookie being set when visiting or updating a feed even if Safari is configured to block cookies via the 'Accept Cookies' preference. (CVE-2010-0044) - An issue in Safari's handling of external URL schemes could cause a local file to be opened in response to a URL encountered on a web page, which could allow a malicious web server to execute arbitrary code. (CVE-2010-0045) - A memory corruption issue in WebKit's handling of CSS format() arguments could lead to a crash or arbitrary code execution. (CVE-2010-0046) - A use-after-free issue in the handling of HTML object element fallback content could lead to a crash or arbitrary code execution. (CVE-2010-0047) - A use-after-free issue in WebKit's parsing of XML documents could lead to a crash or arbitrary code execution. (CVE-2010-0048) - A use-after-free issue in the handling of HTML elements containing right-to-left displayed text could lead to a crash or arbitrary code execution. (CVE-2010-0049) - A use-after-free issue in WebKit's handling of incorrectly nested HTML tags could lead to a crash or arbitrary code execution. (CVE-2010-0050) - An implementation issue in WebKit's handling of cross- origin stylesheet requests when visiting a malicious website could result in disclosure of the content of protected resources on another website. (CVE-2010-0051) - A use-after-free issue in WebKit's handling of callbacks for HTML elements could lead to a crash or arbitrary code execution. (CVE-2010-0052) - A use-after-free issue in the rendering of content with a CSS display property set to 'run-in' could lead to a crash or arbitrary code execution. (CVE-2010-0053) - A use-after-free issue in WebKit's handling of HTML image elements could lead to a crash or arbitrary code execution. (CVE-2010-0054)
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 45045
    published 2010-03-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45045
    title Safari < 4.0.5 Multiple Vulnerabilities
  • NASL family Peer-To-Peer File Sharing
    NASL id ITUNES_9_1_BANNER.NASL
    description The version of Apple iTunes on the remote host is prior to version 9.1. It is, therefore, affected by multiple vulnerabilities : - A buffer underflow in ImageIO's handling of TIFF images can lead to a denial of service or arbitrary code execution. (CVE-2009-2285) - An integer overflow in the application's handling of images with an embedded color profile can lead to a denial of service or arbitrary code execution. (CVE-2010-0040) - An uninitialized memory access vulnerability in ImageIO's handling of BMP images can result in the sending of sensitive data from Safari's memory to a website under an attacker's control. (CVE-2010-0041) - An uninitialized memory access vulnerability in ImageIO's handling of TIFF images can result in the sending of sensitive data from Safari's memory to a website under an attacker's control. (CVE-2010-0042) - A memory corruption vulnerability in the ImageIO's handling of TIFF images can lead to a denial of service or arbitrary code execution. (CVE-2010-0043) - An infinite loop vulnerability in the application's handling of imported MP4 podcast files can lead to a denial of service or arbitrary code execution. (CVE-2010-0531) - A race condition during the installation process allows a local attacker to modify an unspecified file which can then be executed with SYSTEM privileges. (CVE-2010-0532) - A path searching vulnerability exists that allows code execution if an attacker places a specially crafted DLL in a directory and has a user open another file using iTunes in that directory. (CVE-2010-1795) - Syncing a mobile device can allow a local attacker to gain the privileges of the console user due to an insecure file operation in the handling of log files. (CVE-2010-1768)
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 45391
    published 2010-03-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=45391
    title Apple iTunes < 9.1 Multiple Vulnerabilities (uncredentialed check)
oval via4
accepted 2015-06-22T04:00:46.837-04:00
class vulnerability
contributors
  • name J. Daniel Brown
    organization DTCC
  • name Scott Quint
    organization Quintechssential
  • name Shane Shaffer
    organization G2, Inc.
  • name Pooja Shetty
    organization SecPod Technologies
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Shane Shaffer
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Bernd Eggenmueller
    organization baramundi software
definition_extensions
  • comment Apple iTunes is installed
    oval oval:org.mitre.oval:def:12353
  • comment Apple Safari is installed
    oval oval:org.mitre.oval:def:6325
description Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.
family windows
id oval:org.mitre.oval:def:6741
status accepted
submitted 2010-04-09T10:30:00.000-05:00
title Apple Safari Prior to 4.0.5 Integer Overflow Vulnerability
version 20
refmap via4
apple
  • APPLE-SA-2010-03-11-1
  • APPLE-SA-2010-03-30-2
bid
  • 38671
  • 38674
confirm
sectrack 1023706
secunia 39135
xf safari-colorsync-bo(56826)
Last major update 24-08-2010 - 01:42
Published 15-03-2010 - 09:28
Last modified 18-09-2017 - 21:30
Back to Top