Sign-up

ID

VAR-201003-0485


CVE

CVE-2010-1176


TITLE

Apple iPhone/iPod touch Safari malformed image remote code execution vulnerability

Trust: 2.1

sources: CNVD: CNVD-2010-0461 // CNVD: CNVD-2010-0452 // BID: 38989 // CNNVD: CNNVD-201003-438

DESCRIPTION

Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings, an array of IMG elements with crafted strings in their SRC attributes, a TBODY element with no associated TABLE element, and certain calls to the delete operator and the cloneNode, clearAttributes, and CollectGarbage methods, possibly a related issue to CVE-2009-0075. iPod touch for Apple iPhone OS of Safari There is a service disruption ( Application crash ) A vulnerability exists that could lead to a condition or arbitrary code execution. The problem is CVE-2009-0075 The problem is related to.Service disruption by a third party via: ( Application crash ) Could be put into a state or execute arbitrary code. iPod touch is an MP4 player released by Apple, and the iPhone is its released smartphone. Apple's iPhone/iPod touch includes a problem with Safari handling web pages that contain malformed \"img\" tags, and remote attackers can exploit vulnerabilities to crash applications. Careful construction of WEB data may execute arbitrary instructions with application privileges. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks may cause denial-of-service conditions. Apple iPhone is a smart phone of Apple (Apple)

Trust: 3.06

sources: NVD: CVE-2010-1176 // JVNDB: JVNDB-2010-003947 // CNVD: CNVD-2010-0461 // CNVD: CNVD-2010-0452 // BID: 38989 // VULHUB: VHN-43781

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2010-0461 // CNVD: CNVD-2010-0452

AFFECTED PRODUCTS

vendor:applemodel:safariscope: - version: -

Trust: 1.4

vendor:nomodel: - scope: - version: -

Trust: 1.2

vendor:applemodel:safariscope:eqversion:*

Trust: 1.0

vendor:applemodel:iosscope:eqversion:ipod touch for 3.1.3

Trust: 0.8

vendor:applemodel:ipod touchscope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.1.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.0.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.0

Trust: 0.3

sources: CNVD: CNVD-2010-0461 // CNVD: CNVD-2010-0452 // BID: 38989 // JVNDB: JVNDB-2010-003947 // CNNVD: CNNVD-201003-438 // NVD: CVE-2010-1176

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-1176
value: HIGH

Trust: 1.0

NVD: CVE-2010-1176
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201003-438
value: CRITICAL

Trust: 0.6

VULHUB: VHN-43781
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2010-1176
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-43781
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-43781 // JVNDB: JVNDB-2010-003947 // CNNVD: CNNVD-201003-438 // NVD: CVE-2010-1176

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.9

sources: VULHUB: VHN-43781 // JVNDB: JVNDB-2010-003947 // NVD: CVE-2010-1176

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201003-438

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201003-438

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-003947

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-43781

PATCH
title:Top Pageurl:http://www.apple.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2010-003947

EXTERNAL IDS
db:BIDid:38989
Trust: 3.2
db:NVDid:CVE-2010-1176
Trust: 2.8
db:EXPLOIT-DBid:11891
Trust: 1.7
db:JVNDBid:JVNDB-2010-003947
Trust: 0.8
db:CNVDid:CNVD-2010-0461
Trust: 0.6
db:CNVDid:CNVD-2010-0452
Trust: 0.6
db:CNNVDid:CNNVD-201003-438
Trust: 0.6
db:SEEBUGid:SSVID-68036
Trust: 0.1
db:VULHUBid:VHN-43781
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2010-0461 // 
            
            
            
            CNVD: CNVD-2010-0452 // 
            
            
            
            VULHUB: VHN-43781 // 
            
            
            
            BID: 38989 // 
            
            
            
            JVNDB: JVNDB-2010-003947 // 
            
            
            
            CNNVD: CNNVD-201003-438 // 
            
            
            
            NVD: CVE-2010-1176

REFERENCES
url:http://nishantdaspatnaik.yolasite.com/ipodpoc1.php
Trust: 3.2
url:http://www.securityfocus.com/bid/38989
Trust: 1.7
url:http://www.exploit-db.com/exploits/11891
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1176
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1176
Trust: 0.8
url:http://www.apple.com/safari/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2010-0461 // 
            
            
            
            CNVD: CNVD-2010-0452 // 
            
            
            
            VULHUB: VHN-43781 // 
            
            
            
            BID: 38989 // 
            
            
            
            JVNDB: JVNDB-2010-003947 // 
            
            
            
            CNNVD: CNNVD-201003-438 // 
            
            
            
            NVD: CVE-2010-1176

CREDITS
Nishant Das Patnaik
Trust: 0.9
sources:
            
            
            BID: 38989 // 
            
            
            
            CNNVD: CNNVD-201003-438

SOURCES
db:CNVDid:CNVD-2010-0461
db:CNVDid:CNVD-2010-0452
db:VULHUBid:VHN-43781
db:BIDid:38989
db:JVNDBid:JVNDB-2010-003947
db:CNNVDid:CNNVD-201003-438
db:NVDid:CVE-2010-1176

LAST UPDATE DATE
2025-04-11T23:09:03.246000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2010-0461date:2010-03-26T00:00:00
db:CNVDid:CNVD-2010-0452date:2010-03-26T00:00:00
db:VULHUBid:VHN-43781date:2010-03-30T00:00:00
db:BIDid:38989date:2015-04-13T21:02:00
db:JVNDBid:JVNDB-2010-003947date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-201003-438date:2010-03-30T00:00:00
db:NVDid:CVE-2010-1176date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2010-0461date:2010-03-26T00:00:00
db:CNVDid:CNVD-2010-0452date:2010-03-26T00:00:00
db:VULHUBid:VHN-43781date:2010-03-29T00:00:00
db:BIDid:38989date:2010-03-26T00:00:00
db:JVNDBid:JVNDB-2010-003947date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-201003-438date:2010-03-29T00:00:00
db:NVDid:CVE-2010-1176date:2010-03-29T19:30:00.437