RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
BID:44984
Info
RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
| Bugtraq ID: | 44984 |
| Class: | Unknown |
| CVE: |
CVE-2010-4010 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2010 12:00AM |
| Updated: | Nov 19 2010 06:36PM |
| Credit: | Matias Eissler and Anibal Sacco of Core Security Technologies |
| Vulnerable: |
Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
Apple Mac OS X is prone to a remote code-execution vulnerability affecting the Apple Type Services (ATS) component.
An attacker can exploit this issue by enticing an unsuspecting user into viewing a document containing malicious fonts. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application.
This issue affects Mac OS X v10.5.8 and Mac OS X Server v10.5.8.
This BID is being retired as a duplicate of BID 44729 (Apple Mac OS X ATSServer CFF 'CharStrings' Index Sign Mismatch Remote Code Execution Vulnerability).
Apple Mac OS X is prone to a remote code-execution vulnerability affecting the Apple Type Services (ATS) component.
An attacker can exploit this issue by enticing an unsuspecting user into viewing a document containing malicious fonts. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application.
This issue affects Mac OS X v10.5.8 and Mac OS X Server v10.5.8.
This BID is being retired as a duplicate of BID 44729 (Apple Mac OS X ATSServer CFF 'CharStrings' Index Sign Mismatch Remote Code Execution Vulnerability).
Exploit / POC
RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Apple Mac OS X Server 10.5.8
Apple Mac OS X 10.5.8
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Apple Mac OS X Server 10.5.8
-
Apple SecUpdSrvr2010-007.dmg
For Mac OS X Server v10.5.8
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.8
-
Apple SecUpd2010-007.dmg
For Mac OS X v10.5.8
http://www.apple.com/support/downloads/
References
RETIRED: Apple Mac OS X Apple Type Services 'CFF' Font Remote Code Execution Vulnerability
References:
References:
- Mac OS X Homepage (Apple)