Apple Mac OS X Screen Effects Password Prompt Buffer Overflow Vulnerability

Bugtraq ID:	8106
Class:	Boundary Condition Error
CVE:	CVE-2003-0518
Remote:	No
Local:	Yes
Published:	Jul 04 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery of this issue credited to Delfim Machado <[email protected]>.
Vulnerable:	Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2
Not Vulnerable:

Apple Mac OS X Screen Effects Password Prompt Buffer Overflow Vulnerability

Apple Mac OS X has a screen saver, entitled Screen Effects, with a password feature. A buffer overflow vulnerability has been reported for the screen saver that may result in an attacker obtaining access to the vulnerable system.

An attacker can exploit this vulnerability by inputting many characters into the password field prompt and sending it to the vulnerable screen saver which will and enable the attacker to access the vulnerable system as the currently logged on user.

** Reports suggest that an attacker supplying an overly long password consisting of about 1368 characters will cause the screen saver to crash.

Apple Mac OS X Screen Effects Password Prompt Buffer Overflow Vulnerability

There is no exploit required.

Apple Mac OS X Screen Effects Password Prompt Buffer Overflow Vulnerability

References:

• Bug in Apple Screen saver (MacSlash)
  
• Mac OS X Homepage (Apple)
  
• Security Updates (Apple)
  
• MacOSX - crash screensaver locked with password and get the desktop back (Delfim Machado )