Apple Safari 2.0.3 (417.9.3) JavaScript - Denial of Service

[Yannick von Arx <yannick.vonarx () yanux ch>]

Apple Safari 2.0.3 (417.9.3) JavaScript - Denial of Service
===========================================================

Release Date:
May 19th, 2006

Vendor:
Apple Computer Inc.

Tested with/under:
Apple Safari 2.0.3 (417.9.3) under Mac OS X 10.4.6 <= affected

Overview:
A vulnerabilitiy exists in Safari 2.0.3 (417.9.3) and perhaps in  
prior versions witch shows up the SRCOD (Spinning Rainbow Cursor Of  
Death)

Technical Details:
Create a new File with following code ...

<script>
for (;;);
</script>

... then save it as a .html file (example.html) now be shure that  
you've enabled JavaScript in the preferences!

For an example klick at the link with Safari (WARNING: Will show up  
the SRCOD [Spinning Rainbow Cursor Of Death])
http://www.yanux.ch/exploits/safari/safari_dos.html

Solution:
Disable JavaScript.

Vendor Status:
Apple has notified of this issues on 05/19/2006

Discovered by:
Yannick von Arx
yannick[dot]vonarx[at]yanux[dot]ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/