ID

VAR-200902-0474

CVE

CVE-2009-0139

TITLE

Apple Mac OS of SMB Component integer overflow vulnerability

DESCRIPTION

Integer overflow in the SMB component in Apple Mac OS X 10.5.6 allows remote SMB servers to cause a denial of service (system shutdown) or execute arbitrary code via a crafted SMB file system that triggers a heap-based buffer overflow. Apple Mac OS X is prone to a buffer-overflow vulnerability that occurs in the SMB component. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will facilitate in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. OS X 10.5.6 and OS X Server 10.5.6 are vulnerable. 1) A race condition error in the AFP Server can be exploited to trigger the execution of an infinite loop by sending a specially crafted file enumeration request. 2) An error in the handling of movie files using the Pixlet codec can be exploited to trigger a memory corruption. 3) An error in the Resource Manager related to CarbonCore can be exploited to trigger a memory corruption via a file containing a specially crafted resource fork. 4) Certificate Assistant handles temporary files in an insecure manner. For more information: SA32663 SA32926 6) An error in CoreText when processing specially crafted Unicode strings can be exploited to cause a heap-based buffer overflow via e.g. a specially crafted web page. 7) The dscl program accepts passwords passed via command line arguments. This can be exploited by local users to obtain the received passwords via the process list. 8) Multiple errors in fetchmail can be exploited by malicious people to cause a crash via overly large e-mail headers. For more information: SA30742 9) Folder Manager creates the "Downloads" folder with global read permissions after a user deletes it. This can be exploited by unprivileged local users to gain access to the "Downloads" folder. 10) An error in the fseventsd program can be exploited to disclose normally restricted filesystem activity via the FSEvents framework. 11) An error in perl when processing Unicode characters can be exploited to trigger a memory corruption and potentially execute arbitrary code. This is related to: SA27546 12) An error handling problem in csregprinter can be exploited to cause a heap-based buffer overflow and potentially gain system privileges. 13) Multiple errors in python have an unknown impact or can be exploited to cause a crash or potentially compromise a vulnerable system. For more information: SA26837 SA31305 14) An uninitialized memory access error in the Remote Apple events server can be exploited to disclose potentially sensitive memory contents via specially crafted Remote Apple events. 15) An error in Server Manager while validating authentication credentials can be exploited to alter the system configuration. 17) An error in the SMB implementation can be exploited to exhaust available memory resources and cause a system shutdown by tricking a user into connecting to a malicious SMB server. 18) An error in SquirrelMail can be exploited to inject and execute arbitrary HTML and script code via a specially crafted email. For more information: SA32143 19) Multiple errors in the X11 server can be exploited by malicious, local users to cause a DoS, disclose potentially sensitive information, or gain escalated privileges. For more information: SA30627 20) Multiple errors in FreeType can be exploited to cause a DoS or compromise an application using the library. For more information: SA20100 SA24768 SA30600 21) Multiple errors in LibX11 can be exploited by malicious, local users to disclose sensitive information, cause a DoS, and gain escalated privileges. For more information: SA24741 22) Xterm creates TTY devices accessible to all users, when used with "luit". This can be exploited to e.g. write data to another user's Xterm. SOLUTION: Apply Apple Security Update 2009-001. http://www.apple.com/support/downloads/ PROVIDED AND/OR DISCOVERED BY: The vendor credits: 6) Rosyna of Unsanity 9) Graham Perrin of CENTRIM, University of Brighton 10) Mark Dalrymple 12) Lars Haulin ORIGINAL ADVISORY: http://support.apple.com/kb/HT3438 OTHER REFERENCES: SA20100: http://secunia.com/advisories/20100/ SA24741: http://secunia.com/advisories/24741/ SA24768: http://secunia.com/advisories/24768/ SA26837: http://secunia.com/advisories/26837/ SA27546: http://secunia.com/advisories/27546/ SA30600: http://secunia.com/advisories/30600/ SA30627: http://secunia.com/advisories/30627/ SA30742: http://secunia.com/advisories/30742/ SA31305: http://secunia.com/advisories/31305/ SA32143: http://secunia.com/advisories/32143/ SA32663: http://secunia.com/advisories/32663/ SA32926: http://secunia.com/advisories/32926/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

digital error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Graham PerrinClint RuohoBilly Rios

SOURCES

LAST UPDATE DATE

2025-04-10T22:43:24.670000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE