Sign-up

ID

VAR-200701-0075


CVE

CVE-2007-0355


TITLE

Apple Mac OS X SLP Daemon Service Registration Local Buffer Overflow Vulnerability

Trust: 0.9

sources: BID: 22101 // CNNVD: CNNVD-200701-303

DESCRIPTION

Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and possibly remote attackers, to gain privileges and possibly execute arbitrary code via a registration request with an invalid attr-list field. Successful exploits may cause arbitrary code to run superuser privileges. Failed exploit attempts will likely cause denial-of-service conditions. Apple Mac OS X 10.4.8 is reported vulnerable; other versions may be affected as well. A local unprivileged user can trigger this vulnerability by submitting malicious requests, resulting in execute arbitrary commands. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. The vulnerability is caused due to a boundary error within the SLP daemon ("slpd") when processing the "attr-list" field of a registration request. Other versions may also be affected. SOLUTION: Grant only trusted users access to affected systems. Disable the service. PROVIDED AND/OR DISCOVERED BY: KF ORIGINAL ADVISORY: http://projects.info-pull.com/moab/MOAB-17-01-2007.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Attackers could exploit these vulnerabilities to execute arbitrary code, gain access to sensitive information, or cause a denial of service. I. Further details are available in the US-CERT Vulnerability Notes Database. These products include Samba and X11. II. Impact The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, and denial of service. III. These and other updates are available via Software Update or via Apple Downloads. IV. References * US-CERT Vulnerability Notes for Apple Security Update 2008-001 - <http://www.kb.cert.org/vuls/byid?searchview&query=apple_security_update_2008_001> * About the security content of Mac OS X 10.5.2 and Security Update2008-001 - <http://docs.info.apple.com/article.html?artnum=307430> * About the Mac OS X 10.5.2 Update - <http://docs.info.apple.com/article.html?artnum=307109> * Mac OS X: Updating your software - <http://docs.info.apple.com/article.html?artnum=106704> * Apple - Support - Downloads - <http://www.apple.com/support/downloads/> * X.org Foundataion Security Advisories - <http://www.x.org/wiki/Development/Security> * Samba Security Releases - <http://www.samba.org/samba/history/security.html> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA08-043B.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA08-043B Feedback VU#774345" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History February 12, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBR7HyXPRFkHkM87XOAQLgawf/WfBp5mjT+DZriprWRqe1HM4Z9SSe/5Dg jMgSlX1j/YJC7FgZfjJvriQ+yXeOnhwvKggfTbkJWej+0AeRbyIUFWD/ZTh2Qylp /1vBehJW9nhT2yMT65/gT/MnbArN11AILkfSGr4W6xLPMR2zq0HsrP2SxYlAVkSO PPlo0KhWWATcjHjJEacdmry4fR6iv6xA0gFjWN6i18VX5LSMOEyO3LpDt+Rk8fet r7Pwi/QEr/nipEEw8R8Jg9+LT8dqQL1t+yhTa5pV1rceuEb3Cz67paHAqRneldW9 SAl/TPznmYCCMHqyOfHdRBUVvOxI09OPjHYkf7ghv5e06LqbfVMZug== =qwP5 -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2007-0355 // JVNDB: JVNDB-2007-001127 // BID: 22101 // VULHUB: VHN-23717 // PACKETSTORM: 53764 // PACKETSTORM: 63540

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.4.8

Trust: 1.6

vendor:applemodel:minimal slp service agentscope:eqversion:10.4.11

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:v10.4.11

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.4.11

Trust: 0.8

vendor:applemodel:mac os serverscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.5.2

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.5.2

Trust: 0.3

sources: BID: 22101 // JVNDB: JVNDB-2007-001127 // CNNVD: CNNVD-200701-303 // NVD: CVE-2007-0355

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-0355
value: HIGH

Trust: 1.0

NVD: CVE-2007-0355
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200701-303
value: HIGH

Trust: 0.6

VULHUB: VHN-23717
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-0355
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-23717
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-23717 // JVNDB: JVNDB-2007-001127 // CNNVD: CNNVD-200701-303 // NVD: CVE-2007-0355

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-23717 // JVNDB: JVNDB-2007-001127 // NVD: CVE-2007-0355

THREAT TYPE

local

Trust: 1.0

sources: BID: 22101 // PACKETSTORM: 53764 // CNNVD: CNNVD-200701-303

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200701-303

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-001127

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-23717

PATCH
title:Security Update 2008-001url:http://docs.info.apple.com/article.html?artnum=307430-en
Trust: 0.8
title:Security Update 2008-001url:http://docs.info.apple.com/article.html?artnum=307430-ja
Trust: 0.8
title:TA08-043Burl:http://software.fujitsu.com/jp/security/vulnerabilities/ta08-043b.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-001127

EXTERNAL IDS
db:BIDid:22101
Trust: 2.8
db:NVDid:CVE-2007-0355
Trust: 2.8
db:USCERTid:TA08-043B
Trust: 2.6
db:SECUNIAid:23796
Trust: 2.6
db:SECTRACKid:1019359
Trust: 2.5
db:SECTRACKid:1017533
Trust: 2.5
db:OSVDBid:32693
Trust: 2.5
db:VUPENid:ADV-2007-0239
Trust: 1.7
db:EXPLOIT-DBid:3151
Trust: 1.7
db:XFid:31562
Trust: 1.4
db:USCERTid:SA08-043B
Trust: 0.8
db:JVNDBid:JVNDB-2007-001127
Trust: 0.8
db:CNNVDid:CNNVD-200701-303
Trust: 0.7
db:CONFIRMid:HTTP://DOCS.INFO.APPLE.COM/ARTICLE.HTML?ARTNUM=307430
Trust: 0.6
db:APPLEid:APPLE-SA-2008-02-11
Trust: 0.6
db:MILW0RMid:3151
Trust: 0.6
db:CERT/CCid:TA08-043B
Trust: 0.6
db:VULHUBid:VHN-23717
Trust: 0.1
db:PACKETSTORMid:53764
Trust: 0.1
db:PACKETSTORMid:63540
Trust: 0.1
sources:
            
            
            VULHUB: VHN-23717 // 
            
            
            
            BID: 22101 // 
            
            
            
            JVNDB: JVNDB-2007-001127 // 
            
            
            
            PACKETSTORM: 53764 // 
            
            
            
            PACKETSTORM: 63540 // 
            
            
            
            CNNVD: CNNVD-200701-303 // 
            
            
            
            NVD: CVE-2007-0355

REFERENCES
url:http://www.securityfocus.com/bid/22101
Trust: 2.5
url:http://www.us-cert.gov/cas/techalerts/ta08-043b.html
Trust: 2.5
url:http://www.osvdb.org/32693
Trust: 2.5
url:http://securitytracker.com/id?1017533
Trust: 2.5
url:http://securitytracker.com/id?1019359
Trust: 2.5
url:http://secunia.com/advisories/23796
Trust: 2.5
url:http://projects.info-pull.com/moab/moab-17-01-2007.html
Trust: 2.1
url:http://docs.info.apple.com/article.html?artnum=307430
Trust: 2.0
url:http://lists.apple.com/archives/security-announce/2008/feb/msg00002.html
Trust: 1.7
url:http://www.frsirt.com/english/advisories/2007/0239
Trust: 1.4
url:http://xforce.iss.net/xforce/xfdb/31562
Trust: 1.4
url:https://www.exploit-db.com/exploits/3151
Trust: 1.1
url:http://www.vupen.com/english/advisories/2007/0239
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/31562
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0355
Trust: 0.8
url:http://jvn.jp/cert/jvnta08-043b/index.html
Trust: 0.8
url:http://jvn.jp/tr/trta08-043b/index.html
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-0355
Trust: 0.8
url:http://www.us-cert.gov/cas/alerts/sa08-043b.html
Trust: 0.8
url:http://www.milw0rm.com/exploits/3151
Trust: 0.6
url:http://milw0rm.com/exploits/3151
Trust: 0.6
url:http://www.apple.com/macosx/
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/software_inspector/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/96/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/23796/
Trust: 0.1
url:http://docs.info.apple.com/article.html?artnum=307109>
Trust: 0.1
url:http://www.samba.org/samba/history/security.html>
Trust: 0.1
url:http://www.us-cert.gov/cas/techalerts/ta08-043b.html>
Trust: 0.1
url:http://www.x.org/wiki/development/security>
Trust: 0.1
url:http://docs.info.apple.com/article.html?artnum=307430>
Trust: 0.1
url:http://www.apple.com/support/downloads/>
Trust: 0.1
url:http://docs.info.apple.com/article.html?artnum=106704>
Trust: 0.1
url:http://www.us-cert.gov/cas/signup.html>.
Trust: 0.1
url:http://www.us-cert.gov/legal.html>
Trust: 0.1
url:http://www.kb.cert.org/vuls/byid?searchview&query=apple_security_update_2008_001>
Trust: 0.1
sources:
            
            
            VULHUB: VHN-23717 // 
            
            
            
            BID: 22101 // 
            
            
            
            JVNDB: JVNDB-2007-001127 // 
            
            
            
            PACKETSTORM: 53764 // 
            
            
            
            PACKETSTORM: 63540 // 
            
            
            
            CNNVD: CNNVD-200701-303 // 
            
            
            
            NVD: CVE-2007-0355

CREDITS
Kevin Finisterre  dotslash@snosoft.com LMH  lmh@info-pull.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200701-303

SOURCES
db:VULHUBid:VHN-23717
db:BIDid:22101
db:JVNDBid:JVNDB-2007-001127
db:PACKETSTORMid:53764
db:PACKETSTORMid:63540
db:CNNVDid:CNNVD-200701-303
db:NVDid:CVE-2007-0355

LAST UPDATE DATE
2025-04-10T22:32:38.837000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-23717date:2017-10-19T00:00:00
db:BIDid:22101date:2008-02-12T00:16:00
db:JVNDBid:JVNDB-2007-001127date:2008-02-25T00:00:00
db:CNNVDid:CNNVD-200701-303date:2007-01-21T00:00:00
db:NVDid:CVE-2007-0355date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-23717date:2007-01-19T00:00:00
db:BIDid:22101date:2007-01-17T00:00:00
db:JVNDBid:JVNDB-2007-001127date:2008-02-25T00:00:00
db:PACKETSTORMid:53764date:2007-01-20T00:09:28
db:PACKETSTORMid:63540date:2008-02-12T22:23:40
db:CNNVDid:CNNVD-200701-303date:2007-01-18T00:00:00
db:NVDid:CVE-2007-0355date:2007-01-19T01:28:00