|
Brought to you by:
Suppliers of:
|
|
|
| |
| It is possible to cause the Mac OS X kernel to crash by specifying a long command line argument. While this primarily affects local users there may be conditions where this situation is remotely exploitable if a program that receives network input spawns another process with user input. It is possible to use this condition to dump small portions of memory back to an attacker. |
| |
Credit:
The original advisory can be found at: http://www.atstake.com/research/advisories/2003/a102803-3.txt.
The information has been provided by Matt Miller and Dave G. of at Stake.
|
| |
Vulnerable systems:
* Mac OS X 10.2.8 and prior
Immune systems:
* Mac OS X 10.2.3
It is possible to cause the Mac OS X kernel to crash by specifying a long command line argument. The length of the total arguments must be within a narrow range to cause this condition. When it occurs, the operating system will immediately crash, not allowing users to perform any task. No logs will be generated, nor will a kernel panic message be displayed. The machine will reboot on its own after several minutes.
It is also possible to use this condition to dump small portions of memory back to an attacker. As far as @stake can tell, only memory addresses are being returned back to the user, which is typically not sensitive data.
@stake has not fully investigated the extent that this attack can be exploited, but since it appears to be an overflow in the kernel, the severity of "possibly execute commands as root" is warranted.
Vendor Response:
Kernel: Fixes CAN-2003-0895 where it may be possible for a local user to cause the Mac OS X kernel to crash by specifying a long command line argument. The machine will reboot on its own after several minutes.
This is fixed in Mac OS X 10.3. For further information on Mac OS X 10.3, please see http://www.apple.com/macosx/
Recommendation:
Upgrade to Panther (Mac OS X 10.3)
|
|
|
|
|
