Vulnerabilities > CVE-2007-6359 - Numeric Errors vulnerability in Apple mac OS X 10.5.1
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The cs_validate_page function in bsd/kern/ubc_subr.c in the xnu kernel 1228.0 and earlier in Apple Mac OS X 10.5.1 allows local users to cause a denial of service (failed assertion and system crash) via a crafted signed Mach-O binary that causes the hashes function to return NULL.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 |
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Apple Mac OS X xnu <= 1228.0 super_blob Local kernel Denial of Service PoC. CVE-2007-6359. Dos exploit for osx platform |
| id | EDB-ID:4723 |
| last seen | 2016-01-31 |
| modified | 2007-12-12 |
| published | 2007-12-12 |
| reporter | mu-b |
| source | https://www.exploit-db.com/download/4723/ |
| title | Apple Mac OS X xnu <= 1228.0 - super_blob Local kernel Denial of Service PoC |
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_10_5_3.NASL description The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. Mac OS X 10.5.3 contains security fixes for a number of programs. last seen 2020-06-01 modified 2020-06-02 plugin id 32477 published 2008-05-29 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32477 title Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if ( NASL_LEVEL < 3004 ) exit(0); include("compat.inc"); if (description) { script_id(32477); script_version("1.27"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863", "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268", "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388", "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030", "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035", "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574", "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579", "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655"); script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28633", "28694", "29480", "29481", "29483", "29484", "29486", "29487", "29488", "29489", "29490", "29491", "29492", "29493", "29500", "29501", "29511", "29513", "29514", "29520", "29521"); script_xref(name:"Secunia", value:"30430"); script_name(english:"Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities"); script_summary(english:"Check the version of Mac OS X"); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes various security issues." ); script_set_attribute(attribute:"description", value: "The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. Mac OS X 10.5.3 contains security fixes for a number of programs." ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" ); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" ); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" ); script_set_attribute(attribute:"solution", value: "Upgrade to Mac OS X 10.5.3 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13"); script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl"); exit(0); } os = get_kb_item("Host/MacOSX/Version"); if (!os) os = get_kb_item("Host/OS"); if (!os) exit(0); if (ereg(pattern:"Mac OS X 10\.5\.[0-2]([^0-9]|$)", string:os)) security_hole(0);NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2008-003.NASL description The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. This update contains security fixes for a number of programs. last seen 2020-06-01 modified 2020-06-02 plugin id 32478 published 2008-05-29 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/32478 title Mac OS X Multiple Vulnerabilities (Security Update 2008-003) code # # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if ( NASL_LEVEL < 3004 ) exit(0); include("compat.inc"); if (description) { script_id(32478); script_version("1.31"); script_cvs_date("Date: 2018/07/14 1:59:35"); script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863", "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268", "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388", "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030", "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035", "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574", "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579", "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655"); script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28694", "29480", "29481", "29483", "29484", "29486", "29487", "29488", "29489", "29490", "29491", "29492", "29493", "29500", "29501", "29511", "29513", "29514", "29520", "29521"); script_xref(name:"Secunia", value:"30430"); script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2008-003)"); script_summary(english:"Check for the presence of Security Update 2008-003"); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes various security issues." ); script_set_attribute(attribute:"description", value: "The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. This update contains security fixes for a number of programs." ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" ); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" ); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" ); script_set_attribute(attribute:"solution", value: "Install Security Update 2008-003 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399); script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29"); script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13"); script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/MacOSX/packages", "Host/uname"); exit(0); } uname = get_kb_item("Host/uname"); if (!uname) exit(0); if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname)) { packages = get_kb_item("Host/MacOSX/packages"); if (!packages) exit(0); if (!egrep(pattern:"^SecUpd(Srvr)?(2008-00[3-8]|2009-|20[1-9][0-9]-)", string:packages)) security_hole(0); }
References
- http://digit-labs.org/files/exploits/xnu-superblob-dos.c
- http://digit-labs.org/files/exploits/xnu-superblob-dos.c
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://secunia.com/advisories/28048
- http://secunia.com/advisories/28048
- http://secunia.com/advisories/30430
- http://secunia.com/advisories/30430
- http://www.securityfocus.com/bid/26840
- http://www.securityfocus.com/bid/26840
- http://www.us-cert.gov/cas/techalerts/TA08-150A.html
- http://www.us-cert.gov/cas/techalerts/TA08-150A.html
- http://www.vupen.com/english/advisories/2007/4216
- http://www.vupen.com/english/advisories/2007/4216
- http://www.vupen.com/english/advisories/2008/1697
- http://www.vupen.com/english/advisories/2008/1697
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38997
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38997