Apple Finder Denial of Service Vulnerability

Bugtraq ID:	31720
Class:	Design Error
CVE:	CVE-2008-3643
Remote:	Yes
Local:	No
Published:	Oct 09 2008 12:00AM
Updated:	Oct 15 2008 04:37PM
Credit:	Sergio 'shadown' Alvarez of n.runs AG
Vulnerable:	Apple Mac OS X Server 10.5.5 Apple Mac OS X 10.5.5
Not Vulnerable:

Apple Finder Denial of Service Vulnerability

Apple Finder is prone to a denial-of-service vulnerability.

This issue arises when the application tries to create an icon for maliciously crafted files that are located on the desktop. Successful exploits may allow attackers to crash the affected application, denying service to legitimate users.

This issue affects Mac OS X v10.5.5 and Mac OS X Server v10.5.5.

NOTE: This issue was previously covered in BID 31681 (Apple Mac OS X 2008-007 Multiple Security Vulnerabilities) but has been given its own record to better document the vulnerability.

Apple Finder Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple Finder Denial of Service Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


Apple Mac OS X 10.5.5

• Apple SecUpd2008-007.dmg
  http://www.apple.com/support/downloads/securityupdate2008007clientleop ard.html

Apple Mac OS X Server 10.5.5

• Apple SecUpdSrvr2008-007.dmg
  http://www.apple.com/support/downloads/securityupdate2008007serverleop ard.html

Apple Finder Denial of Service Vulnerability

References:

• Mac OS X Homepage (Apple)
  
• About Security Update 2008-007 (Apple)