[NEWS] Mac OS X Long argv[] Buffer Overflow
From: SecuriTeam (support_at_securiteam.com)
Date: 10/29/03
- Previous message: SecuriTeam: "[NEWS] Mac OS X Arbitrary File Overwrite via Core Files"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 29 Oct 2003 15:02:28 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Mac OS X Long argv[] Buffer Overflow
------------------------------------------------------------------------
SUMMARY
It is possible to cause the Mac OS X kernel to crash by specifying a long
command line argument. While this primarily affects local users there may
be conditions where this situation is remotely exploitable if a program
that receives network input spawns another process with user input. It is
possible to use this condition to dump small portions of memory back to an
attacker.
DETAILS
Vulnerable systems:
* Mac OS X 10.2.8 and prior
Immune systems:
* Mac OS X 10.2.3
It is possible to cause the Mac OS X kernel to crash by specifying a long
command line argument. The length of the total arguments must be within a
narrow range to cause this condition. When it occurs, the operating system
will immediately crash, not allowing users to perform any task. No logs
will be generated, nor will a kernel panic message be displayed. The
machine will reboot on its own after several minutes.
It is also possible to use this condition to dump small portions of memory
back to an attacker. As far as @stake can tell, only memory addresses are
being returned back to the user, which is typically not sensitive data.
@stake has not fully investigated the extent that this attack can be
exploited, but since it appears to be an overflow in the kernel, the
severity of "possibly execute commands as root" is warranted.
Vendor Response:
Kernel: Fixes CAN-2003-0895 where it may be possible for a local user to
cause the Mac OS X kernel to crash by specifying a long command line
argument. The machine will reboot on its own after several minutes.
This is fixed in Mac OS X 10.3. For further information on Mac OS X 10.3,
please see <http://www.apple.com/macosx/> http://www.apple.com/macosx/
Recommendation:
Upgrade to Panther (Mac OS X 10.3)
ADDITIONAL INFORMATION
The original advisory can be found at:
<http://www.atstake.com/research/advisories/2003/a102803-3.txt>
http://www.atstake.com/research/advisories/2003/a102803-3.txt.
The information has been provided by Matt Miller and
<mailto:daveg@atstake.com> Dave G. of @Stake.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NEWS] Mac OS X Arbitrary File Overwrite via Core Files"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
