Description: Multiple vulnerabilities have been reported in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.
1) An integer overflow in the "searchfs()" system call when handling the sizeofsearchparams1 and sizeofsearchparams2 variables in a fssearchblock structure can be exploited to cause a buffer overflow.
Successful exploitation may allow execution of arbitrary code with escalated privileges.
The vulnerability has been reported in Mac OS X 10.3.4 as of 22nd June 2004 (Darwin kernel xnu-517.7.7). Other versions may also be affected.
Reportedly, several older NetBSD vulnerabilities including a signedness error in the "semop()" system call still affect Mac OS X (see other references for more information).
2) Signedness errors in the "parse_machfile()" function within the Mach-O loader can be exploited to crash the system via a specially crafted Mach-O header.
The vulnerability has been reported in Mac OS X 10.3.7 and prior.
Solution: The vulnerabilities have been fixed in Mac OS X 10.3.9 Update.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
