Apple Mac OS X Font Book Font Collection Buffer Overflow Vulnerability

Bugtraq ID:	14445
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 01 2005 12:00AM
Updated:	Aug 01 2005 12:00AM
Credit:	<[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0
Not Vulnerable:

Apple Mac OS X Font Book Font Collection Buffer Overflow Vulnerability

Apple Font Book is prone to a buffer overflow vulnerability. This issue is exposed when the application handles font collection files. The vulnerability is due to insufficient bounds checking in user-supplied data contained in font collection bundles, causing an internal buffer to be overrun and memory corruption to occur. As these files may originate from an external source, this issue is considered remotely exploitable.

The application may be a default handler for these files, making it possible to exploit this issue through a malicious Web page or other means.

If the vulnerability is successfully exploited, it may result in execution of arbitrary code in the context of the user running the application.

Apple Mac OS X Font Book Font Collection Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mailus at: [email protected] <mailto:[email protected]>.

Apple Mac OS X Font Book Font Collection Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Apple Mac OS X Font Book Font Collection Buffer Overflow Vulnerability

References:

• Apple Security Updates (Apple)
  
• Mac OS X Homepage (Apple)