Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
BID:24159
Info
Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 24159 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2386 |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2007 12:00AM |
| Updated: | Nov 03 2007 01:26AM |
| Credit: | Michael Lynn of Juniper Networks discovered this vulnerability. |
| Vulnerable: |
Apple TV 1.0 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 |
| Not Vulnerable: |
Apple TV 1.1 |
Discussion
Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
Apple Mac OS X is prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary machine code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts likely result in a denial-of-service condition.
Apple Mac OS X 10.4.0 through 10.4.9 are vulnerable to this issue.
This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been split into its own record.
The vendor reports this issue also affects Apple TV versions prior to 1.1.
Apple Mac OS X is prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary machine code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts likely result in a denial-of-service condition.
Apple Mac OS X 10.4.0 through 10.4.9 are vulnerable to this issue.
This issue was originally included in BID 24144 (Apple Mac OS X 2007-005 Multiple Security Vulnerabilities), but has been split into its own record.
The vendor reports this issue also affects Apple TV versions prior to 1.1.
Exploit / POC
Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
An exploit is available to members of the Immunity Partner's program:
https://www.immunityinc.com/downloads/immpartners/MU.tar.gz
The exploit is not known to be available to the public.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
An exploit is available to members of the Immunity Partner's program:
https://www.immunityinc.com/downloads/immpartners/MU.tar.gz
The exploit is not known to be available to the public.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for more information.
Apple Mac OS X Server 10.4.9
Apple Mac OS X 10.4.9
Solution:
Updates are available. Please see the references for more information.
Apple Mac OS X Server 10.4.9
-
Apple SecUpd2007-005Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13995&cat= 1&platform=osx&method=sa/SecUpd2007-005Ti.dmg -
Apple SecUpd2007-005Univ.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13998&cat= 1&platform=osx&method=sa/SecUpd2007-005Univ.dmg
Apple Mac OS X 10.4.9
References
Apple Mac OS X mDNSResponder Remote Buffer Overflow Vulnerability
References:
References: