A vulnerability has been discovered in Mac OS X, which can be exploited by malicious people to potentially compromise a vulnerable system.

The vulnerability is caused due to an error in libc when processing floating point numbers passed to the "strtod()" function. This can be exploited to corrupt memory when an application passes a specially crafted floating point number to the "strtod()" function or another function calling it (e.g. the "atof()" function).

The vulnerability is confirmed in Mac OS X 10.5.8 and reported in Mac OS X 10.6.

NOTE: Currently, there is no application known that can be used as attack vector.

Solution
There is no effective solution.

Provided and/or discovered by
Maksymilian Arciemowicz and sp3x

Original Advisory
http://securityreason.com/achievement_securityalert/81

Deep Links
Links available in Customer Area