CVE-2010-0048

Vulnerability

A use-after-free vulnerability exists in WebKit, the rendering engine used by Apple Safari, in versions prior to 4.0.5. The bug is triggered when processing a crafted XML document, leading to a use-after-free condition. This affects Safari on Mac and Windows, and also impacts iOS devices running versions prior to iOS 4 [1][2]. The vulnerability is present in the WebKit component and can be exploited without any special configuration beyond visiting a malicious website.

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted XML document on a website and luring a user to visit that page. No additional authentication or network position is required beyond standard web access. The user interaction is limited to simply loading the malicious page. The use-after-free occurs during parsing of the XML, allowing the attacker to control the freed memory and potentially execute arbitrary code.

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the victim's system with the privileges of the user running Safari. This can lead to full compromise of the affected system, including data theft, installation of malware, or further network propagation. Alternatively, the vulnerability can cause a denial of service via application crash.

Mitigation

Apple addressed this vulnerability in Safari 4.0.5 [2] and in iOS 4 [1]. Users should update to the latest versions of Safari or iOS. For Linux systems using WebKit, Ubuntu released updates as part of USN-1006-1 [3]. No workarounds are documented; the only mitigation is to apply the available patches.