Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

Bugtraq ID:	10406
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 24 2004 12:00AM
Updated:	May 24 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to kang <[email protected]>.
Vulnerable:	Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0
Not Vulnerable:

Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

It has been reported that Mac OS X may be prone to a vulnerability that could allow a remote attacker to execute arbitrary script code on a vulnerable system.

The issue presents itself due to the 'ssh:' protocol implemented by the Mac OS X ssh client application. It has been reported that the 'ssh:' protocol can be invoked remotely through a web browser. This could allow an attacker to craft a malicious link and entice a user to follow the link in order to execute code code via the ssh application.

Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

There is no exploit required.

Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Apple Mac OS X SSH URI Handler Remote Code Execution Vulnerability

References:

• SSH URI handler code execution (kang )
  
• Vendor Home Page (Apple)