Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Moderately critical

Mac OS X Updated Version Addresses Thirteen Vulnerabilities

-

Release Date:  2003-10-29    Last Update:  2003-11-20    Views:  16,066

Secunia Advisory SA10086

Where:

From local network

Impact:

Security Bypass, Exposure of sensitive information, Privilege escalation, DoS

Solution Status:

Vendor Patch

Operating System:

CVE Reference(s):

Description


Multiple vulnerabilities have been reported in Mac OS X, where the impact spans from local DoS (Denial of Service) vulnerabilities to privilege escalation, security bypasses and information disclosure.

1) A boundary error in the handling of argv[] arguments can be exploited by malicious, local users to crash the kernel by supplying an overly long command line argument. The vulnerability may possibly also be exploited to escalate privileges, though this hasn't been proven.

The vulnerability could potentially also be exploited remotely if an application spawns a new process based on user input.

Versions 10.2.8 and prior are affected.

2) Due to generally insecure file permissions and an error in handling DMG files, it is possible for malicious, local users to overwrite some executable files. This may be exploited to gain escalated privileges by tricking another user into running an overwritten file.

Versions 10.2.8 and prior are affected.

3) Malicious, local users can overwrite arbitrary files on a system or read core files dumped by privileged processes if core file creation is enabled (disabled by default). This can be exploited via symlink attacks to gain knowledge of sensitive information or corrupt files.

Versions 10.2.8 and prior are affected.

4) The slpd daemon creates temporary files insecurely in the "/tmp" folder when "Personal File Sharing" is enabled (disabled by default). This can be exploited by malicious, local users to overwrite arbitrary files on a system via symlink attacks.

5) An older vulnerability in ktrace can potentially be exploited by malicious, local users to gain knowledge of sensitive information by tracing a specially privileged process.

Successful exploitation requires that the KTRACE kernel option is enabled.

6) An older vulnerability in NFS (Network File System) can be exploited by a malicious user to cause a vulnerable system to lock up by sending specially crafted RPC messages with a zero length payload.

7) An older format string vulnerability in the gm4 utility can potentially be exploited by malicious, local users to escalate privileges.

Successful exploitation requires that a suid program relies on gm4. According to Apple, no privileged applications do this by default.

8) A vulnerability in OpenSSH can be exploited by users to access the system from IPs that they where not supposed to.

For more information:
SA8974

9) An older vulnerability in the nidump utility can be exploited by malicious, local users to read the encrypted passwords in the password file.

10) Due to an error after authenticating with an administrator password, malicious users can access "Preference Panes" that they normally can't access for a short period of time.

11) Since TCP timestamps are initialised with a constant number, malicious people can determine how long a system has been running based on the ID in TCP packets.

12) The Mail application will silently fall back to plain-text authentication when an account is configered to use MD5 Challenge Response but the hashed login fails.

13) It is possible to access Dock functions blindly behind Screen Effects when Full Keyboard Access is enabled.


Solution:
Upgrade to Mac OS X 10.3 (Panther) or apply Security Update 2003-11-19.

Further details available to Secunia VIM customers

Provided and/or discovered by:
Matt Miller and Dave G, @stake (issues #1-4)
Anthony Holder (issue #10)
Aaron Linville (issue #11)
Chris Adams (issue #12)

Original Advisory:
@stake - Long argv[] Buffer Overflow:
http://www.atstake.com/research/advisories/2003/a102803-3.txt

@stake - Systemic Insecure File Permissions:
http://www.atstake.com/research/advisories/2003/a102803-2.txt

@stake - Arbitrary File Overwrite via Core Files:
http://www.atstake.com/research/advisories/2003/a102803-1.txt

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Mac OS X Updated Version Addresses Thirteen Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability