Braden Thomas has reported a vulnerability in iSync, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error in the handling of the "-v" and "-a" command line options. This can be exploited to cause a buffer overflow by supplying an overly long argument (over 4096 bytes).

Successful exploitation allows execution of arbitrary code with the privileges of the mRouter application.

The vulnerability has been reported in Mac OS X 10.3.7 and prior.

Solution
Apply Security Update 2005-004.
Further details available to Secunia VIM customers

Provided and/or discovered by
Braden Thomas

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=301326

Deep Links
Links available to Secunia VIM customers