smcFanControl Local Buffer Overflow Vulnerability

Bugtraq ID:	32252
Class:	Boundary Condition Error
CVE:	CVE-2008-6252
Remote:	No
Local:	Yes
Published:	Nov 11 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	KaiJern, Lau
Vulnerable:	Hendrik Holtmann smcFanControl 2.1.2
Not Vulnerable:	Hendrik Holtmann smcFanControl 2.1.3 1

smcFanControl Local Buffer Overflow Vulnerability

smcFanControl is prone to a local buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input.

Local attackers can exploit this issue to execute arbitrary code in the context of the affected application or to gain SYSTEM-level privileges. Failed attempts will cause denial-of-service conditions.

smcFanControl 2.1.2 is vulnerable; other versions may also be affected.

smcFanControl Local Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept is available:

$ gdb -q /Applications/smcFanControl.app/Contents/Resources/smc
Reading symbols for shared libraries ... done
(gdb) r -k `ruby -e 'print "A" * 45'`BBBBCCCC

smcFanControl Local Buffer Overflow Vulnerability

Solution:
Fixes are available. Please see the references for more information.

smcFanControl Local Buffer Overflow Vulnerability

References:

• Buffer overflows in smcFanControl 2.1.2 for OSX (KaiJern, Lau)
  
• smcFanControl 2.1.3.1 (Hendrik Holtmann)
  
• smcFanControl Homepage (Hendrik Holtmann)