Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
BID:28339
Info
Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
| Bugtraq ID: | 28339 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0989 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 18 2008 12:00AM |
| Updated: | Jan 23 2012 06:50PM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
Gentoo Linux Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
Apple Mac OS X is prone to a local format-string vulnerability. This occurs because 'mDNSResponderHelper' fails to adequately sanitize user-supplied input before passing it to a formatted-printing function.
Successfully exploiting this issue will allow local attackers to execute arbitrary machine code with superuser privileges, completely compromising the computer. Failed exploit attempts will likely result in a denial of service.
NOTE: This vulnerability was previously covered in BID 28304 (Apple Mac OS X 2008-002 Multiple Security Vulnerabilities), but has been given its own record to better document the issue.
Apple Mac OS X is prone to a local format-string vulnerability. This occurs because 'mDNSResponderHelper' fails to adequately sanitize user-supplied input before passing it to a formatted-printing function.
Successfully exploiting this issue will allow local attackers to execute arbitrary machine code with superuser privileges, completely compromising the computer. Failed exploit attempts will likely result in a denial of service.
NOTE: This vulnerability was previously covered in BID 28304 (Apple Mac OS X 2008-002 Multiple Security Vulnerabilities), but has been given its own record to better document the issue.
Exploit / POC
Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
Solution:
Updates are available. Please see the references for more information.
Apple Mac OS X 10.5.2
Apple Mac OS X Server 10.5.2
Solution:
Updates are available. Please see the references for more information.
Apple Mac OS X 10.5.2
-
Apple SecUpd2008-002.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002.dmg
Apple Mac OS X Server 10.5.2
References
Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability
References:
References: