WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.6.3 are reportedly affected by the following issues:

  - A memory corruption issue exists in WebKit that can allow malicious websites to crash the application and possibly execute arbitrary code. (CVE-2012-0672)

  - A heap-based buffer overflow exists related to the handling of 'm3u' playlist files. This error can cause the application to crash or possibly allow arbitrary code execution. (CVE-2012-0677)


The version of Apple iTunes on the remote Windows host is prior to version 10.6.3. It is, therefore, affected by the following vulnerabilities :

  - A memory corruption vulnerability exists in the WebKit     component. By using a specially crafted website, an     attacker can exploit this to cause a denial of service     or execute arbitrary code. Note that this vulnerability     was addressed on Mac OS X systems by an update for     Safari and, therefore, may not necessarily affect the     remote host. (CVE-2012-0672)

  - Stack and heap based buffer overflow errors exist in     the handling of 'm3u' playlist files. An attacker can     exploit these to cause a denial of service or execute     arbitrary code. (CVE-2012-0677)

The version of Apple iTunes installed on the remote Windows host is older than 10.6.3 and is, therefore, affected by the following issues :

  - A memory corruption issue exists in WebKit that can     allow malicious websites to crash the application and     possibly to execute arbitrary code. (CVE-2012-0672)

  - Stack and heap based buffer overflow errors related to     the handling of 'm3u' playlist files. These errors can     cause the application to crash or possibly allow     arbitrary code execution. (CVE-2012-0677)

The remote host has Safari installed. 

Versions of Safari earlier than 5.1.7 are reportedly affected by several issues :

  - Two unspecified errors that can allow malicious sites to perform cross-site scripting attacks. (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can allows malicious sites to crash the application or potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious sites to populate HTML form values of other sites with arbitrary data. (CVE-2012-0676)

The version of Safari installed on the remote host reportedly is affected by several issues :

  - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.1.7.  It is, therefore, potentially affected by several issues :

   - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 3.0 through 5.1.0 are affected by vulnerabilities within the following components :

 - Safari
 - WebKit

The mobile device is running a version of iOS that is older than version 5.1.1.  Version 5.1.1 contains numerous security-related fixes for the following vulnerabilities :

  - Attackers can use a vulnerability in WebKit to perform     cross-site scripting attacks, possibly leaking data such     as cookies, user information, and passwords.
    (CVE-2011-3046, CVE-2011-3056)

  - A remote code execution vulnerability in WebKit could     allow a malicious site to run code on the host iOS     device giving the attacker access to critical data on     the phone.(CVE-2012-0672)

  - Vulnerabilities in Safari can allow malicious sites to     spoof the address in the address bar of the browser.
    This attack allows an attacker to redirect victims to a     malicious site without the user's ability to notice.
    (CVE-2012-0674)

ID	Name	Product	Family	Severity
61458	Ubuntu 12.04 LTS : webkit vulnerabilities (USN-1524-1)	Nessus	Ubuntu Local Security Checks	critical
6500	iTunes < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
59498	Apple iTunes < 10.6.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
59497	Apple iTunes < 10.6.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
800989	Safari < 5.1.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6483	Safari < 5.1.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
59069	Safari < 5.1.7 Multiple Vulnerabilities	Nessus	Windows	high
59068	Mac OS X : Apple Safari < 5.1.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
6481	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
60027	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2012-0672

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

critical