ID

VAR-200807-0648

CVE

CVE-2008-2321

TITLE

Apple Mac OS X of CoreGraphics Vulnerable to arbitrary code execution

DESCRIPTION

Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unknown vectors involving "processing of arguments.". Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2008-005. The security update addresses a total of six new vulnerabilities that affect the CarbonCore, CoreGraphics, Data Detectors Engine, Disk Utility, OpenLDAP, and QuickLook components of Mac OS X. The advisory also contains security updates for 11 previously reported issues. NOTE: This BID is being retired; the following individual records have been created to better document these issues: 30487 Apple Mac OS X CarbonCore Stack Based Buffer Overflow 30488 Apple Mac OS X CoreGraphics Multiple Memory Corruption Vulnerabilities 30489 Apple Mac OS X CoreGraphics Heap Based Buffer Overflow Vulnerability 30490 Apple Mac OS X Data Detectors Engine Denial Of Service Vulnerability 30492 Apple Mac OS X Disk Utility Privilege Escalation Vulnerability 30493 Apple Mac OS X QuickLook Multiple Memory Corruption Vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the affected application or cause denial-of-service conditions. 1) A vulnerability in BIND can be exploited to poison the DNS cache. For more information: SA30973 2) A boundary error exists in CarbonCore when handling filenames. This can be exploited to cause a stack-based buffer overflow via overly long filenames. Successful exploitation of the vulnerability may allow execution of arbitrary code. 3) Multiple errors exist in CoreGraphics when processing received arguments. These can be exploited to trigger a memory corruption by e.g. tricking a user into visiting a specially crafted website. Successful exploitation of the vulnerability may allow execution of arbitrary code. 4) An integer overflow error exists in CoreGraphics when handling PDF files. This can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file. Successful exploitation of the vulnerability may allow execution of arbitrary code. 5) Multiple errors in QuickLook when downloading Microsoft Office files can be exploited to cause a memory corruption. Successful exploitation of the vulnerability may allow execution of arbitrary code. 6) An error exists in the Data Detectors engine when viewing a specially crafted message. This can be exploited to consume overly large resources and trigger an application using the engine to terminate. 7) The problem is that the "Repair Permissions" tool included in Disk Utility sets the "setuid" bit on "/usr/bin/emacs". This can be exploited to execute arbitrary commands with system privileges. 8) An error in OpenLDAP when parsing ASN.1 BER encoded packets can be exploited to cause a DoS. For more information: SA30853 9) A boundary error exists in the OpenSSL "SSL_get_shared_ciphers()" function. For more information see vulnerability #4 in: SA22130 10) Some vulnerabilities in PHP can be exploited malicious users to bypass certain security restrictions, and potentially by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. For more information: SA30048 11) Two vulnerabilities in rsync can be exploited by malicious users to bypass certain security restrictions. For more information: SA27863 SOLUTION: Apply Security Update 2008-005. Security Update 2008-005 Server (PPC): http://www.apple.com/support/downloads/securityupdate2008005serverppc.html Security Update 2008-005 Server (Intel): http://www.apple.com/support/downloads/securityupdate2008005serverintel.html Security Update 2008-005 (PPC): http://www.apple.com/support/downloads/securityupdate2008005ppc.html Security Update 2008-005 (Intel): http://www.apple.com/support/downloads/securityupdate2008005intel.html Security Update 2008-005 (Leopard): http://www.apple.com/support/downloads/securityupdate2008005leopard.html PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Dan Kaminsky of IOActive 2) Thomas Raffetseder of the International Secure Systems Lab and Sergio 'shadown' Alvarez of n.runs AG. 3) Michal Zalewski, Google 4) Pariente Kobi, reported via iDefense 7) Anton Rang and Brian Timares ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT2647 OTHER REFERENCES: SA22130: http://secunia.com/advisories/22130/ SA27863: http://secunia.com/advisories/27863/ SA30048: http://secunia.com/advisories/30048/ SA30973: http://secunia.com/advisories/30973/ SA30853: http://secunia.com/advisories/30853/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Hi all, I am way behind on this, so I wanted to drop a quick note regarding some of my vulnerabilities recently addressed by browser vendors - and provide some possibly interesting PoCs / fuzzers to go with them: Summary : MSIE same-origin bypass race condition (CVE-2007-3091) Impact : security bypass, possibly more Reported : June 2007 (publicly) PoC URL : http://lcamtuf.coredump.cx/ierace/ Bulletin : http://www.microsoft.com/technet/security/bulletin/MS09-019.mspx Notes : additional credit to David Bloom for developing an improved proof-of-concept exploit Summary : MSIE memory corruption on page transitions Impact : memory corruption, potential code execution Reported : April 2008 (privately) PoC URL : http://lcamtuf.coredump.cx/stest/ (fuzzers) Bulletin : http://www.microsoft.com/technet/security/Bulletin/MS09-014.mspx Notes : - Summary : multiple browsers <CANVAS> implementation crashes (CVE-2008-2321, ???) Impact : memory corruption, potential code execution Reported : February 2008 (privately) PoC URL : http://lcamtuf.coredump.cx/canvas/ (fuzzer) Bulletin : http://lists.apple.com/archives/security-announce/2009/Jun/msg00002.html Bulletin : http://www.opera.com/support/kb/view/882/ Notes : also some DoS issues in Firefox Summary : Safari page transition tailgating (CVE-2009-1684) Impact : page spoofing, navigation target disclosure Reported : February 2008 (privately) PoC URL : http://lcamtuf.coredump.cx/sftrap2/ Bulletin : http://lists.apple.com/archives/security-announce/2009/Jun/msg00002.html Notes : - Cheers, /mz . 1) A vulnerability in CoreGraphics can potentially be exploited to compromise a vulnerable system. For more information: SA31610 3) An error in the processing of TIFF images can cause a device reset. 4) An unspecified error can result in the encryption level for PPTP VPN connections to be lower than expected. 5) A signedness error in the Office Viewer component can potentially be exploited to execute arbitrary code via a specially crafted Microsoft Excel file. This is related to vulnerability #10 in: SA32222 6) A weakness exists in the handling of emergency calls, which can be exploited to bypass the Passcode lock and call arbitrary numbers when physical access to the device is provided. 7) A weakness causes the Passcode lock not to be restored properly. 8) A security issue can result in the content of an SMS message being displayed when the message arrives while the emergency call screen is shown. 9) An error in Safari when handling HTML table elements can be exploited to cause a memory corruption and potentially execute arbitrary code when a user visits a specially crafted web site. 10) An error in Safari when handling embedded iframe elements can be exploited to spoof the user interface via content being displayed outside its boundaries. 11) An error exists in Safari when launching an application while a call approval dialog is shown. It is also possible to block the user's ability to cancel the call. 12) An error in Webkit can be exploited to disclose potentially sensitive data from form fields, although the "Autocomplete" feature is disabled. This is related to vulnerability #8 in: SA32706 SOLUTION: Update to iPhone OS 2.2 or iPhone OS for iPod touch 2.2 (downloadable and installable via iTunes). ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. Other vulnerabilities have also been reported of which some may also affect Safari version 3.x. SOLUTION: Upgrade to Safari version 4, which fixes the vulnerabilities. PROVIDED AND/OR DISCOVERED BY: 1-3) Tavis Ormandy 4) Chris Evans of Google Inc

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

Unknown

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Michal Zalewski※ lcamtuf@echelon.pl

SOURCES

LAST UPDATE DATE

2025-04-10T21:49:54.917000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE