The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Mac OS X CF_CHARSET_PATH Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
Mac OS X is "an operating system for the Apple family of microcomputers".
Local exploitation of a buffer overflow vulnerability within the Core
Foundation Library included by default in Apple Computer Inc.'s Mac OS X
could allow an attacker to gain root privileges.
DETAILS
Vulnerable Systems:
* Mac OS X version 10.3.5
* Mac OS X version 10.3.6
The vulnerability specifically exists due to improper handling of the
CF_CHARSET_PATH environment variable. When a string greater than 1,024
characters is passed via this variable, a stack-based overflow occurs,
allowing the attacker to control program flow by overwriting the
function's return address on the stack.
Any application linked against the Core Foundation Library can be used as
an exploit vector for this vulnerability. Some of the setuid root binaries
that are vulnerable include su, pppd and login.
Analysis:
Successful exploitation of this vulnerability allows for root access. An
attacker needs local access to the victim's system to exploit this
vulnerability. This vulnerability is difficult to workaround due to the
fact that a large number of system binaries are linked against the
vulnerable code.
Workaround:
Restrict local access to trusted users only, as it is impossible to remove
the setuid bit from the affected binaries without severely
limiting the function of the system.
Vendor response:
This vulnerability is addressed in Apple Security Update 2005-003
available at: <http://docs.info.apple.com/article.html?artnum=301061>
http://docs.info.apple.com/article.html?artnum=301061
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0716>
CAN-2005-0716
Disclosure timeline:
02/04/2005 - Initial vendor notification
02/04/2005 - Initial vendor response
03/21/2005 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE.
The original article can be found at:
<www.idefense.com/application/poi/display?id=219&type=vulnerabilities>
www.idefense.com/application/poi/display?id=219&type=vulnerabilities
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
