Apple Mac OS X AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	20144
Class:	Boundary Condition Error
CVE:	CVE-2006-3507 CVE-2006-3508 CVE-2006-3509
Remote:	Yes
Local:	No
Published:	Sep 21 2006 12:00AM
Updated:	Sep 18 2007 11:50PM
Credit:	David Maynor is credited with the discovery of CVE-2006-3508. The other issues were disclosed by the vendor.
Vulnerable:	Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9
Not Vulnerable:	Cosmicperl Directory Pro 10.0.3 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0

Apple Mac OS X AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities

The Apple Mac OS X AirPort wireless driver is prone to multiple buffer-overflow vulnerabilities because it fails to perform sufficient bounds checking before copying data to finite-sized buffers.

An attacker can exploit these issues to have arbitrary machine code execute with kernel-level privileges. One of the issues allows code execution in the context of an application using the wireless API. This may lead to denial-of-service conditions or the complete compromise of the affected computer.

Apple Mac OS X AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities

A proof-of-concept exploit is available for CVE-2006-3508.

• /data/vulnerabilities/exploits/20144.zip

Apple Mac OS X AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities

Solution:
Apple has released an advisory along with fixes to address these issues. Please see the references for more information.

Apple Mac OS X AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities

References:

• AirPort Product Page (Apple)
  
• Apple AirPort wireless drivers fails to properly handle scan cache updates (US-CERT)
  
• Apple AirPort wireless drivers vulnerable to integer overflow (US-CERT)
  
• Apple AirPort wireless vulnerabile to buffer overflow (US-CERT)
  
• APPLE-SA-2006-09-21 AirPort Update 2006-001 and (Apple)