[NEWS] Mac OS X CF_CHARSET_PATH Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 03/22/05

  • Next message: SecuriTeam: "[UNIX] Multiple Vulnerabilities in PHP (Information Discloser, File Access, Negative Reference, Integer Handeling Bug, Buffer Overflow, Directory Traversal, Arbitrary File Upload)" 
    To: list@securiteam.com
Date: 22 Mar 2005 10:23:13 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Mac OS X CF_CHARSET_PATH Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    Mac OS X is "an operating system for the Apple family of microcomputers".
    Local exploitation of a buffer overflow vulnerability within the Core
    Foundation Library included by default in Apple Computer Inc.'s Mac OS X
    could allow an attacker to gain root privileges.

    DETAILS

    Vulnerable Systems:
     * Mac OS X version 10.3.5
     * Mac OS X version 10.3.6

    The vulnerability specifically exists due to improper handling of the
    CF_CHARSET_PATH environment variable. When a string greater than 1,024
    characters is passed via this variable, a stack-based overflow occurs,
    allowing the attacker to control program flow by overwriting the
    function's return address on the stack.

    Any application linked against the Core Foundation Library can be used as
    an exploit vector for this vulnerability. Some of the setuid root binaries
    that are vulnerable include su, pppd and login.

    Analysis:
    Successful exploitation of this vulnerability allows for root access. An
    attacker needs local access to the victim's system to exploit this
    vulnerability. This vulnerability is difficult to workaround due to the
    fact that a large number of system binaries are linked against the
    vulnerable code.

    Workaround:
    Restrict local access to trusted users only, as it is impossible to remove
    the setuid bit from the affected binaries without severely
    limiting the function of the system.

    Vendor response:
    This vulnerability is addressed in Apple Security Update 2005-003
    available at: <http://docs.info.apple.com/article.html?artnum=301061>
    http://docs.info.apple.com/article.html?artnum=301061

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0716>
    CAN-2005-0716

    Disclosure timeline:
    02/04/2005 - Initial vendor notification
    02/04/2005 - Initial vendor response
    03/21/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <www.idefense.com/application/poi/display?id=219&type=vulnerabilities>
    www.idefense.com/application/poi/display?id=219&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Multiple Vulnerabilities in PHP (Information Discloser, File Access, Negative Reference, Integer Handeling Bug, Buffer Overflow, Directory Traversal, Arbitrary File Upload)"

    Relevant Pages

    • [NT] Virtual PC Services Insecure Temporary File Creation (MS04-005)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... several guest operating systems under the Mac OS X and Windows platforms. ... attacker with interactive login access to the system may leverage insecure ... The vulnerability could not be exploited remotely without a ...
      (Securiteam)
    • [UNIX] Multiple Vendor X Server CID-keyed Fonts scan_cidfont() Integer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont' Integer Overflow ... vulnerability in the 'scan_cidfont' function in the X.Org and XFree86 X ... 08/25/2005 Initial vendor response ...
      (Securiteam)
    • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
      (Securiteam)
    • [UNIX] SCO Multiple Local Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
      (Securiteam)
    • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
      (Securiteam)