ID

VAR-201008-0304

CVE

CVE-2010-1794

TITLE

Apple Mac OS X WebDAV Kernel Extension Local Denial Of Service Vulnerability

DESCRIPTION

The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field. Attackers can exploit this issue to trigger a kernel panic resulting in a denial-of-service condition. Mac OS X is a BSD-derived operating system developed and maintained by Apple. ==Notes on Disclosure== My disclosure of this issue prior to an official fix is not meant to be taken as a statement against Apple's management of security issues. Local denial-of-service issues are by nature low impact - many security teams do not regard these as security-relevant at all.\xa0 I believe the chances of exploitation of this in real life are practically non-existent.\xa0 Given that the vulnerability resides in an open source kernel extension, I chose to disclose this issue so that concerned administrators can apply a fix immediately, while the rest of us can benefit from a little increased awareness of potentially unsafe memory allocation situations.\xa0 Apple's security team was contacted prior to disclosure, and I'm sure they'll incorporate a fix in a future release. ==Solution== The WebDAV kernel extension can be obtained online [2].\xa0 The following patch can be applied to this extension, after which it should be recompiled to replace the existing extension at /System/Library/Extensions/webdav_fs.kext: --- webdav_fs.kextproj.orig/webdav_fs.kmodproj/webdav_vfsops.c 2010-07-21 09:51:09.000000000 -0400 +++ webdav_fs.kextproj/webdav_fs.kmodproj/webdav_vfsops.c 2010-07-21 10:32:43.000000000 -0400 @@ -319,6 +319,12 @@ static int webdav_mount(struct mount *mp \xa0\xa0\xa0\xa0 } \xa0\xa0\xa0\xa0 /* Get the server sockaddr from the args */ +\xa0\xa0\xa0 if(args.pa_socket_namelen > NAME_MAX) +\xa0\xa0\xa0 { +\xa0\xa0\xa0 \xa0\xa0\xa0 error = EINVAL; +\xa0\xa0\xa0 \xa0\xa0\xa0 goto bad; +\xa0\xa0\xa0 } + \xa0\xa0\xa0\xa0 MALLOC(fmp->pm_socket_name, struct sockaddr *, args.pa_socket_namelen, M_TEMP, M_WAITOK); \xa0\xa0\xa0\xa0 error = copyin(args.pa_socket_name, fmp->pm_socket_name, args.pa_socket_namelen); \xa0\xa0\xa0\xa0 if (error) ==Credits== This vulnerability was discovered by Dan Rosenberg (dan.j.rosenberg@gmail.com). ==References== CVE identifier CVE-2010-1794 has been assigned to this issue by Apple. [1] http://en.wikipedia.org/wiki/WebDAV [2] http://opensource.apple.com/source/webdavfs/webdavfs-293/webdav_fs.kextproj/webdav_fs.kmodproj/

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

permissions and access control

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Dan Rosenberg

SOURCES

LAST UPDATE DATE

2025-04-11T23:05:57.694000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE