Apple Mac OS X Java 'mediaLibImage' Object Handling Remote Code Execution Vulnerability

Bugtraq ID:	40238
Class:	Boundary Condition Error
CVE:	CVE-2010-0538
Remote:	Yes
Local:	No
Published:	May 18 2010 12:00AM
Updated:	May 18 2010 12:00AM
Credit:	Marc Schoenefeld of University of Bamberg
Vulnerable:	Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:

Apple Mac OS X Java 'mediaLibImage' Object Handling Remote Code Execution Vulnerability

Apple Mac OS X is prone to a vulnerability that lets attackers run arbitrary code because the software fails to properly handle Java applets containing malicious 'mediaLibImage' objects.

Successful exploits will allow an attacker to run arbitrary code in the context of the affected software. Failed exploit attempts may result in denial-of-service conditions.

This issue affects the following:

Mac OS X 10.5.8 (and prior versions)
Mac OS X Server 10.5.8 (and prior versions)
Mac OS X 10.6.3 (and prior versions)
Mac OS X Server 10.6.3 (and prior versions)

Apple Mac OS X Java 'mediaLibImage' Object Handling Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple Mac OS X Java 'mediaLibImage' Object Handling Remote Code Execution Vulnerability

References:

• Mac OS X Homepage (Apple)