Critical Apple flaw discovered in Mac OS X

Article

Critical Apple flaw discovered in Mac OS X

Robert Westervelt, News Editor
A critical vulnerability discovered in Apple Computer Inc.'s Mac OS X could be exploited remotely by an attacker to compromise a user's system.

Danish vulnerability clearinghouse Secunia rated the flaw highly critical because it can be remotely exploited by an attacker in the Safari Web browser when the "opening safe files after downloading" option is enabled, Secunia said in its advisory.

The flaw, discovered by security researcher who goes by the name "LMH," is an integer overflow error in the ffs_mountfs() function. When the ffs mountfs() function handles UFS filesystem disc images the operating system can be exploited to cause a buffer overflow by using a UFS DMG image, LMH said in his Month of Apple Bugs Web site.

The flaw can lead to an exploitable denial of service condition and potential arbitrary code execution, LMH said.

"Arbitrary code execution is possible, as we control the size parameter used for buffer allocation and data is being copied directly from the stream in the DMG image," LMH said in his advisory.

Mac OS X 10.4.8 is affected as well as FreeBSD 6.1. Earlier versions may also be affected, LMH said.

The recommended workaround until Apple releases a fix is to not attempt to mount untrusted DMG files, and disable Safari 'Open safe files' in it's preferences dialog.

The flaw is related to a DMG image handling

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

issue announced in November by the Month of Kernel Bugs, LMH said.

The Month of Apple Bugs project was launched Jan. 1 and is an offshoot of the Month of Kernel Bugs project, both run by researcher LMH. The Month of Kernel Bugs was inspired by the Month of Browser Bugs, spearheaded by Metasploit Framework creator H.D. Moore last July.

The Month of Apple Bugs site was launched detailing a highly critical flaw in Apple's widely used QuickTime media player.


Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.