Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
BID:26510
Info
Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 26510 |
| Class: | Design Error |
| CVE: |
CVE-2007-6165 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2007 12:00AM |
| Updated: | Dec 18 2007 08:06PM |
| Credit: | heise Security and Xeno Kovah disclosed this issue. |
| Vulnerable: |
Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
Apple Mac OS X is prone to a vulnerability that can allow arbitrary code to run. This issue affects the Mail application when handling email attachments.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. This will compromise the application and possibly the underlying operating system.
This issue affects Mac OS X 10.5.
NOTE: This vulnerability may be related to CVE-2007-0395 documented in BID 16907 (Apple Mac OS X Security Update 2006-001 Multiple Vulnerabilities). Although the issues seem similar in nature, this may not be the very same underlying vulnerability. We will update this BID as more information emerges.
UPDATE (November 21, 2007): Reports indicate that this issue occurs because of an error in the application's quarantine feature. We have not confirmed this information.
UPDATE (December 17, 2007): This vulnerability stems from an unspecified implementation issue in the Launch Services application.
http://www.securityfocus.com/bid/16907
Apple Mac OS X is prone to a vulnerability that can allow arbitrary code to run. This issue affects the Mail application when handling email attachments.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. This will compromise the application and possibly the underlying operating system.
This issue affects Mac OS X 10.5.
NOTE: This vulnerability may be related to CVE-2007-0395 documented in BID 16907 (Apple Mac OS X Security Update 2006-001 Multiple Vulnerabilities). Although the issues seem similar in nature, this may not be the very same underlying vulnerability. We will update this BID as more information emerges.
UPDATE (November 21, 2007): Reports indicate that this issue occurs because of an error in the application's quarantine feature. We have not confirmed this information.
UPDATE (December 17, 2007): This vulnerability stems from an unspecified implementation issue in the Launch Services application.
http://www.securityfocus.com/bid/16907
Exploit / POC
Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted email attachment.
A proof of concept is available:
To exploit this issue, an attacker must entice an unsuspecting user to open a maliciously crafted email attachment.
A proof of concept is available:
Solution / Fix
Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
Solution:
The vendor has released updates to address this issue. Please see the references for more information.
Apple Mac OS X Server 10.5.1
Apple Mac OS X 10.5.1
Solution:
The vendor has released updates to address this issue. Please see the references for more information.
Apple Mac OS X Server 10.5.1
-
Apple Security Update 2007-009 (10.5.1)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16527&cat= 1&platform=osx&method=sa/SecUpd2007-009.dmg
Apple Mac OS X 10.5.1
-
Apple Security Update 2007-009 (10.5.1)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16527&cat= 1&platform=osx&method=sa/SecUpd2007-009.dmg
References
Apple Mac OS X Mail Arbitrary Code Execution Vulnerability
References:
References:
- Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
- Emailcheck Apple mail (heise Security)
- Apple Mail in Leopard with the same old error (heise Security)