Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
BID:29483
Info
Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
| Bugtraq ID: | 29483 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-1034 |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2008 12:00AM |
| Updated: | Jun 03 2008 04:33PM |
| Credit: | Paul Haddad of PTH Consulting |
| Vulnerable: |
Apple Mac OS X Server 10.4.11 Apple Mac OS X 10.4.11 |
| Not Vulnerable: |
Apple Mac OS X Server 10.5.3 Apple Mac OS X 10.5.3 |
Discussion
Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
Apple Mac OS X Help Viewer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks before copying user-supplied data to an insufficiently-sized buffer.
Attackers can leverage this issue to execute arbitrary code with the privileges of the affected application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions.
NOTE: This issue was previously covered in BID 29412 (Apple Mac OS X 2008-003 Multiple Security Vulnerabilities) but has been given its own record to better document the vulnerability.
Apple Mac OS X Help Viewer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks before copying user-supplied data to an insufficiently-sized buffer.
Attackers can leverage this issue to execute arbitrary code with the privileges of the affected application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions.
NOTE: This issue was previously covered in BID 29412 (Apple Mac OS X 2008-003 Multiple Security Vulnerabilities) but has been given its own record to better document the vulnerability.
Exploit / POC
Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
Solution:
A vendor advisory is available to address the issue. Please see the referenced advisory for more information.
Apple Mac OS X Server 10.4.11
Apple Mac OS X 10.4.11
Solution:
A vendor advisory is available to address the issue. Please see the referenced advisory for more information.
Apple Mac OS X Server 10.4.11
-
Apple Security Update 2008-003 Server (PPC)
http://www.apple.com/support/downloads/securityupdate2008003serverppc. html -
Apple Security Update 2008-003 Server (Universal)
http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html
Apple Mac OS X 10.4.11
-
Apple Security Update 2008-003 (Intel)
http://www.apple.com/support/downloads/securityupdate2008003intel.html -
Apple Security Update 2008-003 (PPC)
http://www.apple.com/support/downloads/securityupdate2008003ppc.html
References
Apple Mac OS X Help Viewer 'help:topic' URI Buffer Overflow Vulnerability
References:
References:
- Mac OS X Homepage (Apple)
- Vulnerability Note VU#566875 (US-CERT)