CVE-2010-1119
published 2010-03-25CVE-2010-1119: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on…
PriorityP356critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
19.02%
97.0th percentile
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
Affected
95 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt"; flow:established,to_client; file.data; content:"document.getElementById|28|"; nocase; content:"id.getAttributeNode|28|"; nocase; distance:0; content:"attribute.childNodes"; nocase; distance:0; content:"document.body.removeChild|28|"; nocase; distance:0; content:"attribute.removeChild|28|"; fast_pattern; nocase; distance:0; reference:bid,40642; reference:cve,2010-1119; classtype:attempted-user; sid:2012509; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_16, cve CVE_2010_1119, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Detect exploit delivery via sequential presence of JavaScript DOM manipulation strings in HTTP response body: 'document.getElementById(', 'id.getAttributeNode(', 'attribute.childNodes', 'document.body.removeChild(', and 'attribute.removeChild(' — all appearing in close proximity (Snort rule sid:2012509 uses distance:0 chaining).
- →The vulnerability is rooted in WebKit's attribute manipulation memory handling; upstream fix is tracked at WebKit changeset 53501 and 53504 — verify patched WebKit revision in deployed browsers/WebView components. ↗
- ·The Snort/ET rule (sid:2012509) is scoped to HTTP traffic from $EXTERNAL_NET to $HOME_NET with flow:established,to_client — it will not fire on HTTPS/TLS-encrypted traffic without SSL inspection in place.
- ·Red Hat marked the 'qt' package (RHEL 6) as 'Will not fix' and 'webkitgtk' (RHEL 6) as 'Not affected' — detection/patching priority should focus on Apple Safari and Android WebKit-based browsers rather than these Linux packages. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mx95-xphp-56vx: Use-after-free vulnerability in WebKit in Apple Safari before 5
ghsa_unreviewed·2022-05-02
CVE-2010-1119 [HIGH] GHSA-mx95-xphp-56vx: Use-after-free vulnerability in WebKit in Apple Safari before 5
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
Red Hat
WebKit: use-after-free vulnerability in handling of attribute manipulation
vendor_redhat·2010-06-07·CVSS 10.0
CVE-2010-1119 [CRITICAL] CWE-416 WebKit: use-after-free vulnerability in handling of attribute manipulation
WebKit: use-after-free vulnerability in handling of attribute manipulation
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
Package: qt (Red Hat Enterprise Linux 6) - Will not fix
Package: webkitgtk (Red Hat Enterprise Linux 6) - Not affected
Suricata
ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt
suricata·2011-03-16
CVE-2010-1119 ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt
ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Android Webkit removeChild Use-After-Free Remote Code Execution Attempt"; flow:established,to_client; file.data; content:"document.getElementById|28|"; nocase; content:"id.getAttributeNode|28|"; nocase; distance:0; content:"attribute.childNodes"; nocase; distance:0; content:"document.body.removeChild|28|"; nocase; distance:0; content:"attribute.removeChild|28|"; fast_pattern; nocase; distance:0; reference:bid,40642; reference:cve,2010-1119; classtype:attempted-user; sid:2012509; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_16, cve CVE_2010_1119,
http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.htmlhttp://lists.apple.com/archives/security-announce/2010/Jun/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2010/Jun/msg00003.htmlhttp://news.cnet.com/8301-27080_3-20001126-245.htmlhttp://secunia.com/advisories/40105http://secunia.com/advisories/40196http://securityreason.com/securityalert/8128http://securitytracker.com/id?1024067http://support.apple.com/kb/HT4196http://support.apple.com/kb/HT4220http://support.apple.com/kb/HT4225http://twitter.com/thezdi/statuses/11001080021http://www.securityfocus.com/bid/40620http://www.vupen.com/english/advisories/2010/1373http://www.vupen.com/english/advisories/2010/1512https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7037http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.htmlhttp://lists.apple.com/archives/security-announce/2010/Jun/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2010/Jun/msg00003.htmlhttp://news.cnet.com/8301-27080_3-20001126-245.htmlhttp://secunia.com/advisories/40105http://secunia.com/advisories/40196http://securityreason.com/securityalert/8128http://securitytracker.com/id?1024067http://support.apple.com/kb/HT4196http://support.apple.com/kb/HT4220http://support.apple.com/kb/HT4225http://twitter.com/thezdi/statuses/11001080021http://www.securityfocus.com/bid/40620http://www.vupen.com/english/advisories/2010/1373http://www.vupen.com/english/advisories/2010/1512https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7037
2010-03-25
Published