Mac OS X Long argv[] buffer overflow

From: _at_stake Advisories (_at_stake)
Date: 10/28/03

  • Next message: b0f www.b0f.net: "Local root vuln in kpopup" 
    Date: Tue, 28 Oct 2003 12:57:16 -0500
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

                                    @stake, Inc.
                                  www.atstake.com

                                 Security Advisory

    Advisory Name: Long argv[] buffer overflow
     Release Date: 10/28/2003
      Application: Mac OS X
         Platform: Mac OS X (10.2.8 and below)
         Severity: attackers can crash Mac OS X and possibly execute
                   commands as root
           Author: Matt Miller <mpmiller@mac.com>
                   Dave G. <daveg@atstake.com>
    Vendor Status: Vendor has fixed release available
    CVE Candidate: CAN-2003-0895
        Reference: www.atstake.com/research/advisories/2003/a102803-3.txt

    Overview:

    It is possible to cause the the Mac OS X kernel to crash by specifying
    a long command line argument. While this primarily affects local
    users there may be conditions where this situation is remotely
    exploitable if a program which receives network input spawns another
    process with user input. It is possible to use this condition to
    dump small portions of memory back to an attacker.

          
    Details:

    It is possible to cause the Mac OS X kernel to crash by specifying
    a long command line argument. The length of the total arguments must
    be within a narrow range to cause this condition. When it occurs, the
    operating system will immediately crash, not allowing users to perform
    any task. No logs will be generated, nor will a kernel panic message
    be displayed. The machine will reboot on its own after several
    minutes.

    It is also possible to use this condition to dump small portions of
    memory back to an attacker. As far as @stake can tell, only memory
    addresses are being returned back to the user, which is typically
    not sensitive data.

    @stake has not fully investigated the exploitability of this attack
    but since it appears to be an overflow in the kernel the severity
    of "possibly execute commands as root" is warranted.

    Vendor Response:

    Kernel: Fixes CAN-2003-0895 where it may be possible for a local user
    to cause the Mac OS X kernel to crash by specifying a long command
    line argument. The machine will reboot on its own after several
    minutes.

     This is fixed in Mac OS X 10.3. For further information on Mac
     OS X 10.3, please see http://www.apple.com/macosx/

    Recommendation:

    Upgrade to Panther (Mac OS X 10.3)

    Common Vulnerabilities and Exposures (CVE) Information:

    The Common Vulnerabilities and Exposures (CVE) project has assigned
    the following names to these issues. These are candidates for
    inclusion in the CVE list (http://cve.mitre.org), which standardizes
    names for security problems.

     CAN-2003-0895 Long argv[] buffer overflow
     

    @stake Vulnerability Reporting Policy:
    http://www.atstake.com/research/policy/

    @stake Advisory Archive:
    http://www.atstake.com/research/advisories/

    PGP Key:
    http://www.atstake.com/research/pgp_key.asc

    @stake is currently seeking application security experts to fill
    several consulting positions. Applicants should have strong
    application development skills and be able to perform application
    security design reviews, code reviews, and application penetration
    testing. Please send resumes to jobs@atstake.com.

    Copyright 2003 @stake, Inc. All rights reserved.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBP56q50e9kNIfAm4yEQIfagCg8xEZrFfmx1FKQ85aVXs1RGuXa0oAn0Ns
    axaFywG9b7BnO4UdWxNynRwi
    =oSwI
    -----END PGP SIGNATURE-----

  • Next message: b0f www.b0f.net: "Local root vuln in kpopup"
    • Quantcast