[NEWS] Mac OS X Long argv[] Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 10/29/03

  • Next message: SecuriTeam: "[UNIX] mod_security Buffer Overflow (Service Side Include)" 
    To: list@securiteam.com
Date: 29 Oct 2003 15:02:28 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Mac OS X Long argv[] Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    It is possible to cause the Mac OS X kernel to crash by specifying a long
    command line argument. While this primarily affects local users there may
    be conditions where this situation is remotely exploitable if a program
    that receives network input spawns another process with user input. It is
    possible to use this condition to dump small portions of memory back to an
    attacker.

    DETAILS

    Vulnerable systems:
     * Mac OS X 10.2.8 and prior

    Immune systems:
     * Mac OS X 10.2.3

    It is possible to cause the Mac OS X kernel to crash by specifying a long
    command line argument. The length of the total arguments must be within a
    narrow range to cause this condition. When it occurs, the operating system
    will immediately crash, not allowing users to perform any task. No logs
    will be generated, nor will a kernel panic message be displayed. The
    machine will reboot on its own after several minutes.

    It is also possible to use this condition to dump small portions of memory
    back to an attacker. As far as @stake can tell, only memory addresses are
    being returned back to the user, which is typically not sensitive data.

    @stake has not fully investigated the extent that this attack can be
    exploited, but since it appears to be an overflow in the kernel, the
    severity of "possibly execute commands as root" is warranted.

    Vendor Response:
    Kernel: Fixes CAN-2003-0895 where it may be possible for a local user to
    cause the Mac OS X kernel to crash by specifying a long command line
    argument. The machine will reboot on its own after several minutes.

    This is fixed in Mac OS X 10.3. For further information on Mac OS X 10.3,
    please see <http://www.apple.com/macosx/> http://www.apple.com/macosx/

    Recommendation:
    Upgrade to Panther (Mac OS X 10.3)

    ADDITIONAL INFORMATION

    The original advisory can be found at:
    <http://www.atstake.com/research/advisories/2003/a102803-3.txt>
    http://www.atstake.com/research/advisories/2003/a102803-3.txt.

    The information has been provided by Matt Miller and
    <mailto:daveg@atstake.com> Dave G. of @Stake.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] mod_security Buffer Overflow (Service Side Include)"

    Relevant Pages