Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

Bugtraq ID:	28629
Class:	Boundary Condition Error
CVE:	CVE-2008-2006
Remote:	Yes
Local:	No
Published:	May 21 2008 12:00AM
Updated:	May 21 2008 09:14PM
Credit:	CORE Security Technologies
Vulnerable:	Apple iCal 3.0.1
Not Vulnerable:

Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

Apple iCal is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects iCal 3.0.1 running on Mac OS X 10.5.1; previous versions may also be affected.

Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to import a malicious '.ics' file.

A vulnerable '.ics' file will contain the folllowing line:

RRULE:FREQ=DAILY;INTERVAL=1;COUNT=2147483646

The following proof-of-concept '.ics' file is available:

• /data/vulnerabilities/exploits/28629.ics

Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

References:

• Mac OS X Homepage (Apple)
  
• Multiple vulnerabilities in iCal (Core Security Technologies)