Vulnerability CVE-2009-1709 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1709 (CCN-51259)

Assigned:

2009-06-08

Published:

2009-06-08

Updated:

2018-10-03

Summary:

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-399
CWE-416

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-1709

Source: APPLE
Type: Patch, Vendor Advisory
APPLE-SA-2009-06-08-1

Source: SUSE
Type: UNKNOWN
SUSE-SR:2011:002

Source: OSVDB
Type: UNKNOWN
55013

Source: CCN
Type: RHSA-2009-1130
Critical: kdegraphics security update

Source: CCN
Type: SA35379
Apple Safari Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
35379

Source: SECUNIA
Type: UNKNOWN
35576

Source: CCN
Type: SA35581
KDE Multiple Vulnerabilities

Source: CCN
Type: SA35582
KDE Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
36461

Source: SECUNIA
Type: UNKNOWN
43068

Source: CCN
Type: SECTRACK ID: 1022345
Apple Safari Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1022345

Source: CCN
Type: Apple Web site
About the security content of Safari 4.0

Source: CONFIRM
Type: Patch, Vendor Advisory
http://support.apple.com/kb/HT3613

Source: CCN
Type: ASA-2009-251
kdegraphics security update (RHSA-2009-1130)

Source: DEBIAN
Type: DSA-1866
kdegraphics -- several vulnerabilities

Source: CCN
Type: KDE Web site
KDE

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2010:182

Source: CCN
Type: OSVDB ID: 55013
Apple Safari WebKit SVG Animation Element Set.targetElement() Use-after-free Arbitrary Code Execution

Source: REDHAT
Type: UNKNOWN
RHSA-2009:1130

Source: BID
Type: UNKNOWN
35260

Source: CCN
Type: BID-35260
RETIRED: Apple Safari Prior to 4.0 Multiple Security Vulnerabilities

Source: BID
Type: UNKNOWN
35334

Source: CCN
Type: BID-35334
WebKit SVG Animation Elements User After Free Remote Code Execution Vulnerability

Source: CCN
Type: USN-823-1
KDE-Graphics vulnerabilities

Source: VUPEN
Type: Vendor Advisory
ADV-2009-1522

Source: VUPEN
Type: UNKNOWN
ADV-2011-0212

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-09-034/

Source: XF
Type: UNKNOWN
safari-svg-code-execution(51259)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10162

Source: UBUNTU
Type: UNKNOWN
USN-823-1

Source: SUSE
Type: SUSE-SR:2011:002
SUSE Security Summary Report

Source: CCN
Type: ZDI-09-034
Apple Safari SVG Set.targetElement() Memory Corruption Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:apple:safari:0.8:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:0.9:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.0.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:2.0.4:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.3:-:mac:*:*:*:*:*

OR cpe:/a:apple:safari:*:-:mac:*:*:*:*:* (Version <= 4.0_beta)

Configuration 2:

cpe:/a:apple:safari:3.0:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.2:-:windows:*:*:*:*:*

OR cpe:/a:apple:safari:*:-:windows:*:*:*:*:* (Version <= 3.2.3)

Configuration RedHat 1:

cpe:/a:redhat:rhel_productivity:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apple:safari:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:2.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.1:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:4.0.1:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:4.0.2:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:1.3.2:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:0.8:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:3.2.3:*:*:*:*:*:*:*

OR cpe:/a:apple:safari:4.0:beta:*:*:*:*:*:*

OR cpe:/a:apple:safari:0.9:*:*:*:*:*:*:*

AND

cpe:/o:kde:kde:3.0.2:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.2.3:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.3.0:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.3.1:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.1.4:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.2.1:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.3.2:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.2:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.5:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:x86-64:*:*:*:*:*

OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.7:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.8:*:*:*:*:*:*:*

OR cpe:/o:kde:kde:3.5.9:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:8.04:*:lts:*:*:*:*:*

OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20091709	V	CVE-2009-1709	2017-09-27
oval:org.mitre.oval:def:29125	P	RHSA-2009:1130 -- kdegraphics security update (Critical)	2015-08-17
oval:org.mitre.oval:def:13597	P	DSA-1866-1 kdegraphics -- several vulnerabilities	2015-02-23
oval:org.mitre.oval:def:8135	P	DSA-1866 kdegraphics -- several vulnerabilities	2015-02-23
oval:org.mitre.oval:def:13166	P	USN-823-1 -- kdegraphics vulnerabilities	2014-06-30
oval:org.mitre.oval:def:22802	P	ELSA-2009:1130: kdegraphics security update (Critical)	2014-05-26
oval:org.mitre.oval:def:10162	V	Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."	2013-04-29
oval:org.debian:def:1866	V	several vulnerabilities	2009-08-19
oval:com.redhat.rhsa:def:20091130	P	RHSA-2009:1130: kdegraphics security update (Critical)	2009-06-25