CVE-2010-1029
Safari - Stack Consumption Denial of Service via CSS Selector
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-1029. PoCs published by Rad L. Sneak, t12.
AI-analyzed exploit summary This exploit demonstrates a stack overflow vulnerability in Apple Safari 4.0.4 and Google Chrome 4.0.249 caused by an excessively long malformed string within a CSS style tag. The PoC triggers a denial-of-service (DoS) condition, crashing Safari or causing Chrome to display an 'Aw, Snap!' error.
Description
Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a STYLE element composed of a large number of *> sequences.
Exploits (2)
This exploit demonstrates a stack overflow vulnerability in Apple Safari 4.0.4 and Google Chrome 4.0.249 caused by an excessively long malformed string within a CSS style tag. The PoC triggers a denial-of-service (DoS) condition, crashing Safari or causing Chrome to display an 'Aw, Snap!' error.
This Python script acts as a web server that serves a malformed HTML page with an excessively long CSS selector string to trigger a crash in iPhone's CSS parser. The author notes potential for remote code execution based on debug dump analysis.