BID:32879

Apple Mac OS X 'i386_set_ldt' and '1386_get_ldt' Multiple Integer Overflow Vulnerabilities

Info

Apple Mac OS X 'i386_set_ldt' and '1386_get_ldt' Multiple Integer Overflow Vulnerabilities

Bugtraq ID:	32879
Class:	Unknown
CVE:	CVE-2008-4218
Remote:	No
Local:	Yes
Published:	Dec 15 2008 12:00AM
Updated:	Dec 17 2008 09:51PM
Credit:	Richard Vaneeden of IOActive, Inc.
Vulnerable:	Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5

Not Vulnerable:	Apple Mac OS X Server 10.5.6 Apple Mac OS X 10.5.6

Discussion

Apple Mac OS X 'i386_set_ldt' and '1386_get_ldt' Multiple Integer Overflow Vulnerabilities

Apple Mac OS X is prone to multiple integer-overflow vulnerabilities because the software fails to perform adequate boundary checks on integer values.

Local attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting these issues will completely compromise an affected computer. Failed exploit attempts will likely crash the affected computer.

Apple Mac OS X 10.5 through 10.5.5 and Mac OS X Server 10.5 through 10.5.5 are vulnerable.

NOTE: This issue was previously covered in BID 32839 (Apple Mac OS X 2008-008 Multiple Security Vulnerabilities), but has been given its own record to better document the issue.

Exploit / POC

Apple Mac OS X 'i386_set_ldt' and '1386_get_ldt' Multiple Integer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Apple Mac OS X 'i386_set_ldt' and '1386_get_ldt' Multiple Integer Overflow Vulnerabilities

Solution:
The vendor released updates and an advisory. Please see the references for more information.

Apple Mac OS X 10.5