http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011

http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html

APPLE-SA-2011-04-14-1

APPLE-SA-2011-04-14-2

APPLE-SA-2011-04-14-3

71182

43735

43748

43782

44151

44154

http://support.apple.com/kb/HT4596

http://support.apple.com/kb/HT4607

http://www.blackberry.com/btsc/KB26132

DSA-2192

20110414 ZDI-11-104: (Pwn2Own) Webkit CSS Text Element Count Remote Code Execution Vulnerability

46849

1025212

ADV-2011-0645

ADV-2011-0654

ADV-2011-0671

ADV-2011-0984

http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401

http://www.zerodayinitiative.com/advisories/ZDI-11-104

google-webkit-style-code-execution(66052)

Two issues in libwebkit have been fixed :

  - Webkit CSS Text Element Count remote code execution was     fixed. (CVE-2011-1290)

  - WebKit WBR Tag Removal remote code execution was fixed.
    (CVE-2011-1344)

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.2.2 are potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets could lead to a crash or arbitrary code execution. (CVE-2011-1290)

  - A use after free issue in the handling of text nodes could lead to a crash or arbitrary code execution. (CVE-2011-1344)

The version of Apple iTunes on the remote host is prior to version 10.2.2. It is, therefore, affected by multiple vulnerabilities in the WebKit component :

  - An integer overflow vulnerability exists in the handling     of nodesets that can be exploited by a remote attacker     to execute arbitrary code. (CVE-2011-1290)

  - A use-after-free vulnerability exists in the handling of     text nodes that can be exploited by a remote attacker to     execute arbitrary code. (CVE-2011-1344)

Note that these only affect WebKit for Windows.

The version of Apple iTunes installed on the remote Windows host is older than 10.2.2.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use after free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 4.2.5 or 4.2.6 are affected by vulnerabilities within the following components :

  - Certificate Trust Policy

  - QuickLook

  - WebKit

The remote mobile host is a using a version of Apple iOS earlier than 4.3.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.3.2 contains security fixes for the following components :

  - Certificate Trust Policy

  - libxslt

  - QuickLook

  - WebKit

The version of Safari installed on the remote Windows host is earlier than 5.0.5.  It therefore is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0.5.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-0779     Google Chrome before 9.0.597.84 does not properly handle     a missing key in an extension, which allows remote     attackers to cause a denial of service (application     crash) via a crafted extension.

  - CVE-2011-1290     Integer overflow in WebKit allows remote attackers to     execute arbitrary code via unknown vectors, as     demonstrated by Vincenzo Iozzo, Willem Pinckaers, and     Ralf-Philipp Weinmann during a Pwn2Own competition at     CanSecWest 2011.

Versions of Google Chrome earlier than 10.0.648.133 are potentially affected by a memory corruption vulnerability in style handling.  By tricking a user into opening a specially crafted web page, a remote unauthenticated attacker could execute arbitrary script code on the host subject to the privileges of the user running the affected application.

The version of Google Chrome installed on the remote host is earlier than 10.0.648.133.  Such versions are reportedly affected by a memory corruption vulnerability in style handling.

By tricking a user into opening a specially crafted web page, a remote unauthenticated attacker could execute arbitrary script code on the host subject to the privileges of the user running the affected application.

The remote host has Safari installed.

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

The remote host has Safari installed. 

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

ID	Name	Product	Family	Severity
64202	SuSE 11.2 Security Update : libwebkit (SAT Patch Number 7114)	Nessus	SuSE Local Security Checks	critical
5894	iTunes < 10.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
53489	Apple iTunes < 10.2.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
53488	Apple iTunes < 10.2.2 Multiple (credentialed check)	Nessus	Windows	high
5889	Apple iOS 4.2.5 and 4.2.6 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5888	Apple iOS < 4.3.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
53411	Safari < 5.0.5 Multiple Vulnerabilities	Nessus	Windows	high
53410	Mac OS X : Apple Safari < 5.0.5	Nessus	MacOS X Local Security Checks	high
52674	Debian DSA-2192-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	critical
800907	Google Chrome < 10.0.648.133 Code Execution Vulnerability	Log Correlation Engine	Web Clients	high
5818	Google Chrome < 10.0.648.133 Code Execution	Nessus Network Monitor	Web Clients	high
52657	Google Chrome < 10.0.648.133 Code Execution	Nessus	Windows	high
801002	Safari < 5.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5890	Safari < 5.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
51069	FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

CVE-2011-1290

HIGH

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Tenable Plugins

critical

high

high

high

critical

critical

high

high

critical

high

high

high

high

high

critical