Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
BID:12295
Info
Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
| Bugtraq ID: | 12295 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-0972 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 18 2005 12:00AM |
| Updated: | Jul 12 2009 10:06AM |
| Credit: | Discovery is credited to Immunity Inc. |
| Vulnerable: |
Darwin Kernel 7.1 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 |
| Not Vulnerable: |
Apple Mac OS X Server 10.3.9 Apple Mac OS X 10.3.9 |
Discussion
Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
Mac OS X kernel is reported prone to a local integer overflow vulnerability. The issue occurs in the searchfs() code.
The vulnerability exists due to an error in calculating size arguments derived from user-controlled integer values, which are then used in a user-land to kernel memory copy operation.
The issue may be leveraged to corrupt kernel memory and ultimately execute arbitrary code with ring-0 privileges. The issue may also be exploited to trigger a denial of service condition from a kernel panic.
Mac OS X kernel is reported prone to a local integer overflow vulnerability. The issue occurs in the searchfs() code.
The vulnerability exists due to an error in calculating size arguments derived from user-controlled integer values, which are then used in a user-land to kernel memory copy operation.
The issue may be leveraged to corrupt kernel memory and ultimately execute arbitrary code with ring-0 privileges. The issue may also be exploited to trigger a denial of service condition from a kernel panic.
Exploit / POC
Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
The following proof of concept example is available:
The following proof of concept example is available:
Solution / Fix
Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
Solution:
Apple has released Security Advisory APPLE-SA-2005-04-15 along with upgrades dealing with this issue.
Apple Mac OS X Server 10.3
Apple Mac OS X 10.3
Apple Mac OS X Server 10.3.1
Apple Mac OS X 10.3.1
Apple Mac OS X 10.3.2
Apple Mac OS X Server 10.3.2
Apple Mac OS X Server 10.3.3
Apple Mac OS X 10.3.3
Apple Mac OS X Server 10.3.4
Apple Mac OS X 10.3.4
Apple Mac OS X Server 10.3.5
Apple Mac OS X 10.3.5
Apple Mac OS X 10.3.6
Apple Mac OS X Server 10.3.6
Apple Mac OS X Server 10.3.7
Apple Mac OS X 10.3.7
Apple Mac OS X Server 10.3.8
Apple Mac OS X 10.3.8
Solution:
Apple has released Security Advisory APPLE-SA-2005-04-15 along with upgrades dealing with this issue.
Apple Mac OS X Server 10.3
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.1
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.1
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X 10.3.2
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.2
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X Server 10.3.3
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.3
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.4
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.4
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.5
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.5
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X 10.3.6
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.6
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X Server 10.3.7
-
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.7
-
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
Apple Mac OS X Server 10.3.8
-
Apple MacOSXServerUpdate10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05641&plat form=osx&method=sa/MacOSXServerUpdate10.3.9.dmg -
Apple MacOSXSrvrUpdCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05642&plat form=osx&method=sa/MacOSXSrvrUpdCombo10.3.9.dmg
Apple Mac OS X 10.3.8
-
Apple MacOSXUpdate10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05639&plat form=osx&method=sa/MacOSXUpdate10.3.9.dmg -
Apple MacOSXUpdateCombo10.3.9.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05640&plat form=osx&method=sa/MacOSXUpdateCombo10.3.9.dmg
References
Apple Mac OS X Kernel SearchFS Integer Overflow Vulnerability
References:
References:
- Mac OS X Homepage (Apple)
- Various Kernel Level Vulnerabilities in Mac OS X 10.3.x (Immunity Inc.)