Apple Mac OS X AppleTalk Zip-Notify Remote Buffer Overflow Vulnerability

Bugtraq ID:	34201
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 23 2009 12:00AM
Updated:	Mar 23 2009 05:16PM
Credit:	mu-b
Vulnerable:	Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1
Not Vulnerable:

Apple Mac OS X AppleTalk Zip-Notify Remote Buffer Overflow Vulnerability

Apple Mac OS X is prone to a remote buffer-overflow vulnerability.

Remote attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

Mac OS X 10.5.1 and 10.5.2 are vulnerable; other versions may also be affected.

Apple Mac OS X AppleTalk Zip-Notify Remote Buffer Overflow Vulnerability

The following proof of concept demonstrates this issue.

• /data/vulnerabilities/exploits/34201.c

Apple Mac OS X AppleTalk Zip-Notify Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple Mac OS X AppleTalk Zip-Notify Remote Buffer Overflow Vulnerability

References:

• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)