ID

VAR-200807-0646

CVE

CVE-2008-2320

TITLE

Apple Mac OS X of CarbonCore Vulnerable to stack-based buffer overflow

DESCRIPTION

Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long filename to the file management API. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause denial-of-service conditions. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2008-005. The security update addresses a total of six new vulnerabilities that affect the CarbonCore, CoreGraphics, Data Detectors Engine, Disk Utility, OpenLDAP, and QuickLook components of Mac OS X. The advisory also contains security updates for 11 previously reported issues. 1) A vulnerability in BIND can be exploited to poison the DNS cache. For more information: SA30973 2) A boundary error exists in CarbonCore when handling filenames. This can be exploited to cause a stack-based buffer overflow via overly long filenames. Successful exploitation of the vulnerability may allow execution of arbitrary code. 3) Multiple errors exist in CoreGraphics when processing received arguments. These can be exploited to trigger a memory corruption by e.g. tricking a user into visiting a specially crafted website. Successful exploitation of the vulnerability may allow execution of arbitrary code. 4) An integer overflow error exists in CoreGraphics when handling PDF files. This can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file. Successful exploitation of the vulnerability may allow execution of arbitrary code. 5) Multiple errors in QuickLook when downloading Microsoft Office files can be exploited to cause a memory corruption. Successful exploitation of the vulnerability may allow execution of arbitrary code. 6) An error exists in the Data Detectors engine when viewing a specially crafted message. This can be exploited to consume overly large resources and trigger an application using the engine to terminate. 7) The problem is that the "Repair Permissions" tool included in Disk Utility sets the "setuid" bit on "/usr/bin/emacs". This can be exploited to execute arbitrary commands with system privileges. 8) An error in OpenLDAP when parsing ASN.1 BER encoded packets can be exploited to cause a DoS. For more information: SA30853 9) A boundary error exists in the OpenSSL "SSL_get_shared_ciphers()" function. For more information see vulnerability #4 in: SA22130 10) Some vulnerabilities in PHP can be exploited malicious users to bypass certain security restrictions, and potentially by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. For more information: SA30048 11) Two vulnerabilities in rsync can be exploited by malicious users to bypass certain security restrictions. For more information: SA27863 SOLUTION: Apply Security Update 2008-005. Security Update 2008-005 Server (PPC): http://www.apple.com/support/downloads/securityupdate2008005serverppc.html Security Update 2008-005 Server (Intel): http://www.apple.com/support/downloads/securityupdate2008005serverintel.html Security Update 2008-005 (PPC): http://www.apple.com/support/downloads/securityupdate2008005ppc.html Security Update 2008-005 (Intel): http://www.apple.com/support/downloads/securityupdate2008005intel.html Security Update 2008-005 (Leopard): http://www.apple.com/support/downloads/securityupdate2008005leopard.html PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Dan Kaminsky of IOActive 2) Thomas Raffetseder of the International Secure Systems Lab and Sergio 'shadown' Alvarez of n.runs AG. 3) Michal Zalewski, Google 4) Pariente Kobi, reported via iDefense 7) Anton Rang and Brian Timares ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT2647 OTHER REFERENCES: SA22130: http://secunia.com/advisories/22130/ SA27863: http://secunia.com/advisories/27863/ SA30048: http://secunia.com/advisories/30048/ SA30973: http://secunia.com/advisories/30973/ SA30853: http://secunia.com/advisories/30853/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA35379 VERIFY ADVISORY: http://secunia.com/advisories/35379/ DESCRIPTION: Some vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to disclose sensitive information or compromise a user's system. 1) An error in the handling of TrueType fonts can be exploited to corrupt memory when a user visits a web site embedding a specially crafted font. 2) Some vulnerabilities in FreeType can potentially be exploited to compromise a user's system. For more information: SA33970 4) An error in the processing of external entities in XML files can be exploited to read files from the user's system when a users visits a specially crafted web page. Other vulnerabilities have also been reported of which some may also affect Safari version 3.x. SOLUTION: Upgrade to Safari version 4, which fixes the vulnerabilities. PROVIDED AND/OR DISCOVERED BY: 1-3) Tavis Ormandy 4) Chris Evans of Google Inc

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

buffer overflow

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Pariente Kobi

SOURCES

LAST UPDATE DATE

2025-04-10T21:48:16.426000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE