Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Safari JavaScript 'eval' Remote Denial of Service Exploit

Subscribe

Check Point Reference: CPAI-2010-112
Date Published:
Severity:
Source: milwOrm
Industry Reference(s): CVE-2009-3272
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Safari 3.2.3
Vulnerability Description
A vulnerability was reported in Safari 3.2.3, specifically in the WebKit.dll" module which is part of the WebKit layout engine. Safari is reported to crash when interpreting a webpage that calls the "eval" JavaScript function with "A/" repeating 21526 times (43052 bytes). When triggering this vulnerability, Safari will throw a "Stack Overflow"
exception, and then an access violation when adjusting the trigger to "A/" repeating 21697 times (43394 bytes).
Vulnerability Details
The problem has been fixed in Safari 4. According to the researcher, STACK_OVERFLOW does not mean there is a buffer overflow on the stack but rather that the stack for the process has been exhausted and its maximum size has been reached.

Protection Overview
The protection will detect and block JavaScript web pages which try to call the 'eval' function with invalid arguments.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > HTML, and select the Exploit Specific Protections protection group.
3. Click Exploit Specific Protections (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: Exploit Specific Protections
Description: Exploit Specific Protections