[38679] in bugtraq
Re: Safari HTTPS Overflow
daemon@ATHENA.MIT.EDU (Braden Thomas)
Fri Apr 29 12:53:25 2005
In-Reply-To: <5857F6B3-C1DF-4694-BE0B-5D85F0BE4133@neoresearch.org>
Mime-Version: 1.0 (Apple Message framework v622)
Content-Type: text/plain; charset=WINDOWS-1252; delsp=yes; format=flowed
Message-Id: <e63865f36a2130bd3bc5e4c68a7c528d@myrealbox.com>
Cc: bugtraq@securityfocus.com
From: Braden Thomas <braden127@myrealbox.com>
Date: Thu, 28 Apr 2005 19:29:14 -0700
To: Gilbert Verdian <gverdian@neoresearch.org>
Content-Transfer-Encoding: 8bit
Gilbert –
This appears to be an issue where Safari is calling
CFSocketEnableCallBacks on a null CFSocketRef. Not an overflow. An
overflow would require a buffer, somewhere, to have overflowed. This
is not happening at all. Just because a program crashes when you send
it a relatively long string does not define it as an overflow. Look at
the crash report:
Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c
Also, did you notify Apple
(https://bugreport.apple.com/cgi-bin/WebObjects/RadarWeb.woa) of this
bug, or did you just figure they'd hear about it through the grapevine?
Braden Thomas
On Apr 28, 2005, at 2:08 PM, Gilbert Verdian wrote:
> Found a bug in the latest Safari that comes with Panther 10.3.9 -
> Safari 1.3 (v312), previous versions of Panther are also vulnerable.
>
> The problem is with the URI input for HTTPS which causes Safari to
> crash by inputting a large amount of A's i.e.
>
> https://
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>
> Did a debug of the crash, but it kept crashing in a spin_lock while
> reading from the text segment. Will post more details when have more
> info on it.
>
> Gilbert Verdian
> neoresearch.org
