Vulnerabilities > CVE-2008-1034 - Numeric Errors vulnerability in Apple mac OS X

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
apple
CWE-189
critical
nessus
NVD
Published: 2008-06-02
Updated: 2017-08-08

Summary

Integer underflow in Help Viewer in Apple Mac OS X before 10.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted help:topic URL that triggers a buffer overflow.

Vulnerable Configurations

Part Description Count
OS
Apple
36

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_5_3.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. Mac OS X 10.5.3 contains security fixes for a number of programs.
    last seen2020-06-01
    modified2020-06-02
    plugin id32477
    published2008-05-29
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/32477
    titleMac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#


if (!defined_func("bn_random")) exit(0);
if ( NASL_LEVEL < 3004 ) exit(0);



include("compat.inc");

if (description)
{
  script_id(32477);
  script_version("1.27");
  script_cvs_date("Date: 2018/07/14  1:59:35");

  script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863",
                "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268",
                "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388",
                "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030",
                "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035",
                "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574",
                "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579",
                "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655");
  script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28633",
                    "28694", "29480", "29481", "29483", "29484", "29486", "29487", "29488",
                    "29489", "29490", "29491", "29492", "29493", "29500", "29501", "29511",
                    "29513", "29514", "29520", "29521");
  script_xref(name:"Secunia", value:"30430");

  script_name(english:"Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities");
  script_summary(english:"Check the version of Mac OS X");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a Mac OS X update that fixes various
security issues." );
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of Mac OS X 10.5.x that is prior
to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs." );
  script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" );
  script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" );
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" );
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mac OS X 10.5.3 or later." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399);

  script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29");
  script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13");
  script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");
  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
  script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
  exit(0);
}


os = get_kb_item("Host/MacOSX/Version");
if (!os) os = get_kb_item("Host/OS");
if (!os) exit(0);

if (ereg(pattern:"Mac OS X 10\.5\.[0-2]([^0-9]|$)", string:os)) security_hole(0);
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2008-003.NASL
    descriptionThe remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. This update contains security fixes for a number of programs.
    last seen2020-06-01
    modified2020-06-02
    plugin id32478
    published2008-05-29
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/32478
    titleMac OS X Multiple Vulnerabilities (Security Update 2008-003)
    code
    #
# (C) Tenable Network Security, Inc.
#


if (!defined_func("bn_random")) exit(0);
if ( NASL_LEVEL < 3004 ) exit(0);



include("compat.inc");

if (description)
{
  script_id(32478);
  script_version("1.31");
  script_cvs_date("Date: 2018/07/14  1:59:35");

  script_cve_id("CVE-2005-3352", "CVE-2005-3357", "CVE-2006-3747", "CVE-2007-0071", "CVE-2007-1863",
                "CVE-2007-3847", "CVE-2007-4465", "CVE-2007-5000", "CVE-2007-5266", "CVE-2007-5268",
                "CVE-2007-5269", "CVE-2007-5275", "CVE-2007-6019", "CVE-2007-6359", "CVE-2007-6388",
                "CVE-2007-6612", "CVE-2008-0177", "CVE-2008-1027", "CVE-2008-1028", "CVE-2008-1030",
                "CVE-2008-1031", "CVE-2008-1032", "CVE-2008-1033", "CVE-2008-1034", "CVE-2008-1035",
                "CVE-2008-1036", "CVE-2008-1571", "CVE-2008-1572", "CVE-2008-1573", "CVE-2008-1574",
                "CVE-2008-1575", "CVE-2008-1576", "CVE-2008-1577", "CVE-2008-1578", "CVE-2008-1579",
                "CVE-2008-1580", "CVE-2008-1654", "CVE-2008-1655");
  script_bugtraq_id("15834", "25489", "25957", "26840", "26930", "27133", "27642", "28694", "29480",
                    "29481", "29483", "29484", "29486", "29487", "29488", "29489", "29490", "29491",
                    "29492", "29493", "29500", "29501", "29511", "29513", "29514", "29520", "29521");
  script_xref(name:"Secunia", value:"30430");

  script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2008-003)");
  script_summary(english:"Check for the presence of Security Update 2008-003");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a Mac OS X update that fixes various
security issues." );
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of Mac OS X 10.4 that does not
have the security update 2008-003 applied. 

This update contains security fixes for a number of programs." );
  script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT1897" );
  script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2008/May/msg00001.html" );
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/advisories/14755" );
  script_set_attribute(attribute:"solution", value:
"Install Security Update 2008-003 or later." );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Apache Module mod_rewrite LDAP Protocol Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(20, 22, 79, 94, 119, 189, 200, 264, 352, 399);

  script_set_attribute(attribute:"plugin_publication_date", value: "2008/05/29");
  script_set_attribute(attribute:"vuln_publication_date", value: "2005/12/13");
  script_set_attribute(attribute:"patch_publication_date", value: "2008/05/28");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");
  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/MacOSX/packages", "Host/uname");
  exit(0);
}


uname = get_kb_item("Host/uname");
if (!uname) exit(0);

if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname))
{
  packages = get_kb_item("Host/MacOSX/packages");
  if (!packages) exit(0);

  if (!egrep(pattern:"^SecUpd(Srvr)?(2008-00[3-8]|2009-|20[1-9][0-9]-)", string:packages))
    security_hole(0);
}

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 29412 CVE(CAN) ID: CVE-2008-1027,CVE-2008-1028,CVE-2008-1577,CVE-2008-1575,CVE-2008-1580,CVE-2008-1030,CVE-2008-1031,CVE-2008-1032,CVE-2008-1033,CVE-2008-1034,CVE-2008-1035,CVE-2008-1036,CVE-2008-1571,CVE-2008-1572,CVE-2008-1573,CVE-2008-1574,CVE-2008-1576,CVE-2008-1578,CVE-2008-1579 Mac OS X是苹果家族机器所使用的操作系统。 Apple 2008-002安全更新修复了Mac OS X中的多个安全漏洞，远程或本地攻击者可能利用这些漏洞造成多种威胁。 CVE-2008-1027 AFP服务器没有检查所文件或目录是否位于用于共享的文件夹中，即使文件或文件名没有位于所要共享的文件夹中，连接的用户或guest仍可以访问拥有权限的文件或文件夹。 CVE-2008-1028 AppKit处理文档文件时存在实现错误，在使用AppKit的编辑器（如TextEdit）中打开特制文件可能导致应用程序意外终止或执行任意代码。 CVE-2008-1577 使用Pixlet codec处理文件时存在多个内存破坏漏洞，打开特制的电影文件可能导致应用程序意外终止或执行任意代码。 CVE-2008-1575 Apple的Type Services服务器处理PDF文件中内嵌的字体时存在内存破坏漏洞，打印包含有特制字体的PDF文档可能导致执行任意代码。 CVE-2008-1580 Safari的SSL客户端证书处理中存在信息泄露漏洞，当Web服务器发布客户端证书请求时，会自动发送密钥链中找到的第一个客户端证书，这可能导致泄露该证书中所包含的信息。 CVE-2008-1030 CoreFoundation处理CFData对象时存在整数溢出，最终可能导致堆溢出。使用无效长度参数调用CFDataReplaceBytes的应用程序可能意外终止或执行任意代码。 CVE-2008-1031 CoreGraphics处理PDF文件时存在未初始化变量漏洞，打开特制的PDF文件可能导致应用程序意外终止或执行任意代码。 CVE-2008-1032 这个更新扩展了在某些环境下标记为可能为不安全的系统内容类型列表，例如从网页下载的时候。尽管不会自动启动这些内容类型，如果手动打开的话仍可能导致执行恶意的负载。 CVE-2008-1033 如果启用了调试日志的话，CUPS调度程序检查认证环境变量的方式存在漏洞，可能导致在通过受到密码保护的打印机执行打印任务时泄露用户名、域和口令。 CVE-2008-1034 Help Viewer处理help:topic URL时存在整数溢出，访问恶意的help:topic URL可能导致应用程序意外终止或执行任意代码。 CVE-2008-1035 iCal应用程序处理iCalendar文件（通常为.ics）的方式存在释放后使用漏洞，打开特制的iCalendar文件可能导致应用程序意外终止或执行任意代码。 CVE-2008-1036 ICU处理某些字符编码时存在转换漏洞，特制的无效字符序列可能不会出现在转换输出中，这会影响内容过滤器。访问恶意的站点可能导致跨站脚本和泄露敏感信息。 CVE-2008-1571 Image Capture的嵌入web服务器中存在目录遍历漏洞，可能导致泄露服务器系统上的本地文件。 CVE-2008-1572 Image Capture没有安全的处理临时文件，可能允许本地用户以其他运行Image Capture用户的权限覆盖文件，或访问调整大小的图形的内容。 CVE-2008-1573 BMP和GIF图形解码引擎中存在越界内存读取，导致泄露内存内容。 CVE-2008-1574 JPEG2000图形文件处理中的整数溢出可能导致堆溢出，查看特制的JPEG2000图形文件可能导致应用程序意外终止或执行任意代码。 CVE-2008-1576 Mail中存在未初始化缓冲区漏洞。当通过IPv6上的SMTP发送邮件时，Mail可能使用包含有部分未初始化内存的缓冲区，导致向消息收件人或邮件服务器管理员泄露敏感信息，还可能导致应用程序意外终止或执行任意代码。 CVE-2008-1578 sso_util命令行工具要求在参数中向其传送口令，这可能向其他本地用户泄露口令。泄露的口令包括用户、管理员和KDC管理口令。 CVE-2008-1579 在访问不存在的博客时Wiki服务器存在信息泄露漏洞，攻击者可以使用错误消息中的信息推测出是否存在本地用户名。 Apple Mac OS X 10.5 - 10.5.2 Apple Mac OS X 10.4.11 Apple MacOS X Server 10.5 - 10.5.2 Apple MacOS X Server 10.4.11 Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.apple.com/support/downloads/securityupdate2008003intel.html target=_blank>http://www.apple.com/support/downloads/securityupdate2008003intel.html</a> <a href=http://www.apple.com/support/downloads/securityupdate2008003ppc.html target=_blank>http://www.apple.com/support/downloads/securityupdate2008003ppc.html</a> <a href=http://www.apple.com/support/downloads/securityupdate2008003serverppc.html target=_blank>http://www.apple.com/support/downloads/securityupdate2008003serverppc.html</a> <a href=http://www.apple.com/support/downloads/securityupdate2008003serveruniversal.html target=_blank>http://www.apple.com/support/downloads/securityupdate2008003serveruniversal.html</a>
idSSV:3345
last seen2017-11-19
modified2008-05-29
published2008-05-29
reporterRoot
titleApple Mac OS X 2008-003更新修复多个安全漏洞

References