Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Apple Safari CSS format Argument Handling Memory Corruption

Subscribe

Check Point Reference: CPAI-2010-131
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA38932
Industry Reference(s): CVE-2010-0046
Protection Provided by: Security Gateway
  • R75
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Apple Safari prior to 4.0.5
Vulnerability Description
A memory corruption vulnerability exists in Apple Safari, a web browsing application developed by Apple. The browser is capable of processing HTML, images, scripting languages, and various other popular Internet specifications. The vulnerability is due to an error while processing CSS format arguments. A remote attacker can exploit this vulnerability by convincing a target user to open a malicious web page with a vulnerable application.
Update/Patch Available
The vendor, Apple, has released an advisory addressing this vulnerability.
Vulnerability Details
The vulnerability is due to an error in a CSS function. The function incorrectly checks the type of the value being passed to the format parameter. Remote attackers could exploit this vulnerability by convincing the target user to view a malicious HTML document, which allows injection and execution of arbitrary code.

Protection Overview
The protection will detect and block HTML documents containing malformed CSS statements.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice. 

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R75

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > IPS Software Blade > Web Intelligence > HTTP Client Protections.
2. In the right pane, double-click the Apple Safari CSS format Argument Handling Memory Corruption protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings. 
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: Web Client Enforcement Violation
Attack Information: Apple Safari CSS format argument handling memory corruption

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > HTML, and select the Safari protection group.
3. Click Apple Safari CSS Format Argument Handling Memory Corruption (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: Apple Safari Vulnerabilities
Description: Apple Safari CSS Format Argument Handling Memory Corruption