CVE-2005-4504

Safari and TextEdit - Denial of Service via Large ROWSPAN Attribute in TD Tag

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-4504. PoCs published by Tom Ferris.

AI-analyzed exploit summary This exploit leverages a malformed HTML table structure to trigger a denial-of-service (DoS) condition in Apple Mac OS X KHTMLParser, causing applications like Safari and TextEdit to crash. The vulnerability arises from improper handling of malformed HTML attributes.

Description

The khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, as used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Tom Ferris · textdososx

https://www.exploit-db.com/exploits/26971

View Code ZIP pw:eip

This exploit leverages a malformed HTML table structure to trigger a denial-of-service (DoS) condition in Apple Mac OS X KHTMLParser, causing applications like Safari and TextEdit to crash. The vulnerability arises from improper handling of malformed HTML attributes.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: Apple Mac OS X KHTMLParser (Safari 2.0.2 and prior, TextEdit, Mac OS X 10.4.3 and prior)

No auth needed

Prerequisites: Victim must open a maliciously crafted HTML file or visit a malicious webpage

MITRE ATT&CK