Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.

The version of Apple Safari installed on the remote Mac OS X 10.6 host is earlier than 5.1.10. It is, therefore, potentially affected by two memory corruption vulnerabilities in JavaScriptCore's JSArray::sort() method. By tricking a user into visiting a malicious website, an attacker could leverage these issues to cause an application crash or to execute arbitrary code.

Versions of iTunes earlier than 11.0.3 are reportedly affected by several vulnerabilities:

  - An error exists related to certificate validation that could allow disclosure of sensitive information and could allow the application to trust data from untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors that could lead to memory corruption and possibly arbitrary code execution. The vendor notes one possible attack vector is a man-in-the-middle attack while the application browses the 'iTunes Store'. (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748, CVE-2012-5112, CVE-2013-0879, CVE-2013-0912, CVE-2013-0948, CVE-2013-0949, CVE-2013-0950, CVE-2013-0951, CVE-2013-0952, CVE-2013-0953, CVE-2013-0954, CVE-2013-0955, CVE-2013-0956, CVE-2013-0958, CVE-2013-0959, CVE-2013-0960, CVE-2013-0961, CVE-2013-0991, CVE-2013-0992, CVE-2013-0993, CVE-2013-0994, CVE-2013-0995, CVE-2013-0996, CVE-2013-0997, CVE-2013-0998, CVE-2013-0999, CVE-2013-1000, CVE-2013-1001, CVE-2013-1002, CVE-2013-1003, CVE-2013-1004, CVE-2013-1005, CVE-2013-1006, CVE-2013-1007, CVE-2013-1008, CVE-2013-1010, CVE-2013-1011) 

The version of Apple iTunes on the remote host is prior to version 11.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An error exists related to certificate validation. A     man-in-the-middle attacker can exploit this to spoof     HTTPS servers, which allows the disclosure of sensitive     information or the application to trust data from     untrusted sources. Note that this issue affects the     application regardless of the operating system.
    (CVE-2013-1014)

  - The version of WebKit included in iTunes contains     several errors that can lead to memory corruption and     arbitrary code execution. The vendor states that one     possible vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'. Please note that     these vulnerabilities only affect the application when     it is running on a Windows host.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The version of Apple iTunes installed on the remote Windows host is older than 11.0.3.  It therefore is potentially affected by several issues :

  - An error exists related to certificate validation     that could allow disclosure of sensitive information     and could allow the application to trust data from     untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors     that could lead to memory corruption and possibly     arbitrary code execution. The vendor notes one possible     attack vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The remote Mac OS X host has Safari installed. 

Versions of Safari earlier than 6.0.2 are reportedly affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling of JavaScript array in WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images in WebKit code could lead to arbitrary, remote code execution. (CVE-2012-5112)

The remote host has Safari installed. Versions of Safari earlier than 6.0.2 are reportedly affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling of JavaScript array in WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)
 - A use-after-free issue in the handling of SVG images in WebKit code could lead to arbitrary, remote code execution. (CVE-2012-5112)

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - Kernel extension API responses containing an 'OSBundleMachOHeaders' key may include kernel addresses which can aid in further attacks. (CVE-2012-3749)
 - The lock screen can provide 'Passbook' data to an attacker having physical device access but not a passcode. (CVE-2012-3750)
 - A 'time-of-check-to-time-of-use' issue in the handling of JavaScript array data within WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)
 - A use-after-free issue in the handling of SVG images in WebKit could lead to arbitrary, remote code execution. (CVE-2012-5112)

The mobile device is running a version of iOS that is older than version 6.0.1. This version contains security-related fixes for the following issues :

  - Kernel extension API responses containing     an 'OSBundleMachOHeaders' key may include kernel     addresses, which can aid in further attacks.
    (CVE-2012-3749)

  - The lock screen can provide 'Passbook' data to an     attacker having physical device access but not a     passcode. (CVE-2012-3750)

  - A time-of-check-to-time-of-use issue in the handling     of JavaScript array in WebKit could lead to arbitrary,     remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images     in WebKit code could lead to arbitrary, remote code     execution. (CVE-2012-5112)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 6.0.2. It is, therefore, potentially affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling     of JavaScript array in WebKit could lead to arbitrary,     remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images     in WebKit code could lead to arbitrary, remote code     execution. (CVE-2012-5112)

ID	Name	Product	Family	Severity
69879	Mac OS X : Apple Safari < 5.1.10 Memory Corruptions	Nessus	MacOS X Local Security Checks	medium
6831	iTunes < 11.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
66499	Apple iTunes < 11.0.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
66498	Apple iTunes < 11.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
801001	Mac OS X : Safari < 6.0.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6622	Safari < 6.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6615	Apple iOS < 6.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
62803	Apple iOS < 6.0.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
62802	Mac OS X : Apple Safari < 6.0.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2012-3748

high

Tenable Plugins

medium

high

critical

critical

high

high

high

critical

critical