Apple Terminal xterm Resize Escape Sequence Memory Corruption Vulnerability
3 Jun. 2009
Summary
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Terminal. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
Vulnerable Systems:
* Apple Mac OS X version 10.5 through 10.5.6
* Apple Mac OS X version 10.5 through 10.5.6
The specific flaw exists in the handling of 'CSI[4' xterm window resizing escape code. When a very low negative value for (x, y) size is set, an integer overflow occurs resulting in a memory corruption. This can be further leveraged to execute arbitrary code under the context of the logged in user.
Immune Systems:
* Apple Mac OS X version 10.5.7 and later
* Apple Mac OS X version 10.5.7 and later
