Critical Apple flaw discovered in Mac OS X

By Robert Westervelt, News Editor 11 Jan 2007 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

Danish vulnerability clearinghouse Secunia rated the flaw highly critical because it can be remotely exploited by an attacker in the Safari Web browser when the "opening safe files after downloading" option is enabled, Secunia said in its advisory.

The flaw, discovered by security researcher who goes by the name "LMH," is an integer overflow error in the ffs_mountfs() function. When the ffs mountfs() function handles UFS filesystem disc images the operating system can be exploited to cause a buffer overflow by using a UFS DMG image, LMH said in his Month of Apple Bugs Web site.

The flaw can lead to an exploitable denial of service condition and potential arbitrary code execution, LMH said.

"Arbitrary code execution is possible, as we control the size parameter used for buffer allocation and data is being copied directly from the stream in the DMG image," LMH said in his advisory.

Mac OS X 10.4.8 is affected as well as FreeBSD 6.1. Earlier versions may also be affected, LMH said.

The recommended workaround until Apple releases a fix is to not attempt to mount untrusted DMG files, and disable Safari 'Open safe files' in it's preferences dialog.

The flaw is related to a DMG image handling issue announced in November by the Month of Kernel Bugs, LMH said.

The Month of Apple Bugs project was launched Jan. 1 and is an offshoot of the Month of Kernel Bugs project, both run by researcher LMH. The Month of Kernel Bugs was inspired by the Month of Browser Bugs, spearheaded by Metasploit Framework creator H.D. Moore last July.

The Month of Apple Bugs site was launched detailing a highly critical flaw in Apple's widely used QuickTime media player.

Tags: Alternative OS security: Mac, Linux, Unix, etc.,  Application Attacks (Buffer Overflows, Cross-Site Scripting),  Web Browser Security,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Alternative OS security: Mac, Linux, Unix, etc. Machiavelli Mac OS X rootkit unveiled at Black Hat How secure is 'Platform as a Service (PaaS)?' Security comparison: Mac OS X vs. Windows Mac OS memory flaws pose challenges for enterprise endpoint protection Rootkit Hunter demo: Detect and remove Linux rootkits Oracle to buy Sun Microsystems for $7.4 billion How to harden Linux operating systems Serious holes in Mac OS X memory, researcher shows What is the best operating system for an FTP server implementation? Black Hat DC 2009: Mac OS attack method Alternative OS security: Mac, Linux, Unix, etc. Research Application Attacks (Buffer Overflows, Cross-Site Scripting) Adobe warns of critical update for Reader, Acrobat 9.1.3 9 Ways to Improve Application Security After an Incident Developers Need Help with Security Errors Buffer overflow tutorial: How to find vulnerabilities, prevent attacks SQL injection protection: A guide on how to prevent and stop attacks Experts rebuke programmers who use SQL injection as feature SANS: Application threats, website flaws pose biggest security threats Mozilla helps Adobe push out faster patches SSH key compromise shuts down Apache website IBM finds sharp spike in malicious content on trusted sites Application Attacks (Buffer Overflows, Cross-Site Scripting) Research Web Browser Security Microsoft fixes security update that breaks Internet Explorer Mozilla update repairs Firefox buffer overflow vulnerabilities Kaspersky system analyzes malicious URLs on Twitter for malware Silon malware intercepts Internet Explorer sessions, steals credentials Do Facebook URL security concerns justify blocking social networks? Phishing attacks to remain a major problem, say security experts Adrian Perrig: Improve SSL/TLS Security Through Education and Technology New Bahama botnet evades search engines, fuels click fraud SANS: Application threats, website flaws pose biggest security threats Mozilla helps Adobe push out faster patches Web Browser Security Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary trusted computing  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary