Apple Mac OS X LaunchD Local Format String Vulnerability

Bugtraq ID:	18724
Class:	Input Validation Error
CVE:	CVE-2006-1471
Remote:	No
Local:	Yes
Published:	Jun 29 2006 12:00AM
Updated:	Jul 04 2006 07:04PM
Credit:	Kevin Finisterre of DigitalMunition is credited with the discovery of this vulnerability.
Vulnerable:	Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4
Not Vulnerable:	Apple Mac OS X Server 10.4.7 Apple Mac OS X 10.4.7

Apple Mac OS X LaunchD Local Format String Vulnerability

Apple Mac OS X 'launchd' is prone to a local format-string vulnerability. A local attacker can exploit this issue through a malicious 'plist' file that includes externally supplied format specifiers that will be passed to the vulnerable code.

A successful attack may crash the application or lead to arbitrary code execution.

This issue was initially discussed in BID 18686 (Apple Mac OS X Multiple Security Vulnerabilities).

Apple Mac OS X LaunchD Local Format String Vulnerability

The following exploits are available:

• /data/vulnerabilities/exploits/FailureToLaunch.pl
• /data/vulnerabilities/exploits/FailureToLaunch-ppc.pl

Apple Mac OS X LaunchD Local Format String Vulnerability

Solution:
The vendor has released Mac OS X version 10.4.7 to address this and other issues.

Please see the referenced vendor advisories for more information.


Apple Mac OS X Server 10.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.1

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.1

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.2

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.2

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.3

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.3

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.4

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.5

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.5

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.6

• Apple MacOSXServerUpdate10.4.7.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.6

• Apple MacOSXUpd10.4.7Intel.dmg
  for Intel
  http://www.apple.com/support/downloads/


• Apple MacOSXUpd10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X LaunchD Local Format String Vulnerability

References:

• Apple Downloads (Apple)
  
• Apple Security Updates (Apple)
  
• Mac OS X Homepage (Apple)