############################################

Safari for windows 5.1.7 (7534.57.2) Remote code execution

JavaScriptCore.dll (7534.57.3.3)

Vendor notify: NO Exploit available: Private

Advisore:
http://lostmon.blogspot.com.es/2013/12/safari-for-windows-517-7534572-remote.html

 #############################################


Safari for windows is a discontinued product; but in my work ) tecnical
support for clients and bussines) i found it installed in serveral machines.


Iit is prone vulnerable to a buffer overflow in  JavaScriptCore.dll that
allows remote crash if failed or Remote Code Execution if the exploit is
succesfully.


This issue is tiggered when safari try to allocate a large amount of data
in  javascript stack memory.

We espect a " out of memory" alert box, but we can bypass or fuzzing this
alert and result a RCE.


 i don't like the responses from Apple amd this is a discontinued
product.... See Windbg Log for this issue:


(1240.1334): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=00000000 ecx=77d25085 edx=00000000 esi=1d7c0000 edi=7ff90240
eip=61b39357 esp=0023f01c ebp=00000001 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export
symbols for C:\Program Files\Safari\Apple Application
Support\JavaScriptCore.dll -
JavaScriptCore!WTF::fastMalloc+0x157:
61b39357 c705efbeadbb00000000 mov dword ptr ds:[0BBADBEEFh],0
ds:0023:bbadbeef=????????
0:000> !load msec.dll
0:000> !exploitable -m
VERSION:1.6.0.0
IDENTITY:HostMachine\HostUser
PROCESSOR:X86
CLASS:USER
QUALIFIER:USER_PROCESS
EVENT:DEBUG_EVENT_EXCEPTION
EXCEPTION_FAULTING_ADDRESS:0xffffffffbbadbeef
EXCEPTION_CODE:0xC0000005
EXCEPTION_LEVEL:SECOND_CHANCE
EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION
EXCEPTION_SUBTYPE:WRITE
FAULTING_INSTRUCTION:61b39357 mov dword ptr ds:[0bbadbeefh],0
MAJOR_HASH:0x7fdedd27
MINOR_HASH:0x39b7b969
STACK_DEPTH:6
STACK_FRAME:JavaScriptCore!WTF::fastMalloc+0x157
STACK_FRAME:WebKit!WKDictionaryGetTypeID+0xb112
STACK_FRAME:WebKit!WKCredentialGetTypeID+0x1f776
STACK_FRAME:WebKit!WKCredentialGetTypeID+0x489f2
STACK_FRAME:WebKit!WKCredentialGetTypeID+0x4337e
STACK_FRAME:JavaScriptCore!JSC::JSArray::getOwnPropertySlotByIndex+0x2a44
INSTRUCTION_ADDRESS:0x0000000061b39357
INVOKING_STACK_FRAME:0
DESCRIPTION:User Mode Write AV
SHORT_DESCRIPTION:WriteAV
CLASSIFICATION:EXPLOITABLE
BUG_TITLE:Exploitable - User Mode Write AV starting at
JavaScriptCore!WTF::fastMalloc+0x0000000000000157
(Hash=0x7fdedd27.0x39b7b969)
EXPLANATION:User mode write access violations that are not near NULL
are exploitable.0:000> !exploitable

!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at
JavaScriptCore!WTF::fastMalloc+0x0000000000000157
(Hash=0x7fdedd27.0x39b7b969)

User mode write access violations that are not near NULL are exploitable.



-- 
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....



-- 
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....