CVE-2010-0047

Vulnerability

A use-after-free vulnerability exists in WebKit's handling of HTML object element fallback content in Apple Safari versions prior to 4.0.5. The bug occurs when the browser processes specially crafted HTML that triggers a dangling pointer after the object element's fallback content is freed. This allows an attacker to corrupt memory and potentially execute arbitrary code. The vulnerability is present in all Safari versions before 4.0.5 [2].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious website and luring a user to visit it. No authentication or special privileges are required. The attack involves crafting an HTML page with an object element that includes fallback content designed to trigger the use-after-free condition. When the user's browser renders the page, the freed memory is accessed, leading to a crash or code execution [2].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code within the context of the Safari browser, potentially leading to full system compromise. Alternatively, the attacker can cause a denial of service by crashing the application. The impact is high due to the ability to execute arbitrary code without user interaction beyond visiting a malicious site [2].

Mitigation

Apple addressed this vulnerability in Safari 4.0.5, released on March 11, 2010 [2]. Users should update to Safari 4.0.5 or later. Additionally, Ubuntu included a fix in USN-1006-1 for systems using WebKit via the webkit package [3]. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.