Apple Xcode Core Image Fun House '.funhouse' File XML Data Handling Buffer Overflow Vulnerability

Bugtraq ID:	30189
Class:	Boundary Condition Error
CVE:	CVE-2008-2304
Remote:	Yes
Local:	No
Published:	Jul 11 2008 12:00AM
Updated:	Jul 14 2008 04:59PM
Credit:	Kevin Finisterre of Netragard
Vulnerable:	Apple Xcode 2.4.1 Apple Xcode 2.3 Apple Xcode 2.2 Apple Xcode 2.1 Apple Xcode 2.0 Apple Core Image Fun House 0
Not Vulnerable:	Apple Xcode 3.1

Apple Xcode Core Image Fun House '.funhouse' File XML Data Handling Buffer Overflow Vulnerability

Apple Xcode Core Image Fun House is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious '.funhouse' file.

Successfully exploiting this issue will allow the attacker to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Apple Xcode 2.0 through 3.0 are vulnerable.

Apple Xcode Core Image Fun House '.funhouse' File XML Data Handling Buffer Overflow Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious '.funhouse' file.

The following proof of concept is available:

• /data/vulnerabilities/exploits/30189.rb

Apple Xcode Core Image Fun House '.funhouse' File XML Data Handling Buffer Overflow Vulnerability

Solution:
Apple has released Xcode 3.1. Please see the references for more information.

Apple Xcode Core Image Fun House '.funhouse' File XML Data Handling Buffer Overflow Vulnerability

References:

• Core Image Homepage (Apple)
  
• [NETRAGARD SECURITY ADVISORY][Apple Core Image Fun House <= 2.0 OS (Netragard Security Advisories )
  
• About the security content of Xcode tools 3.1 (Apple)