Vulnerability Note VU#172948
Apple Mac OS X AppKit vulnerable to buffer overflow via maliciously crafted Microsoft Word files
A buffer overflow vulnerability exists in a component of Apple's Mac OS X operating system that handles Microsoft Word files.
The Cocoa Application Framework (also referred to as the Application Kit, or AppKit) is one of the core Cocoa frameworks supplied with Apple's Mac OS X operating system. It provides functionality and associated Application Program Interfaces (APIs) for applications, including objects for graphical user interfaces (GUIs), event-handling mechanisms, application services, and drawing and image composition facilities.
A buffer overflow exists in the AppKit component designed to handle Microsoft Word (.doc) files. Apple notes in its security advisory that this vulnerability only affects applications that use AppKit (such as TextEdit) and that Microsoft Word for Mac OS X is not vulnerable. A maliciously crafted .doc file could be used to execute arbitrary code on a vulnerable system.
An attacker with the ability to supply a maliciously crafted Microsoft Word .doc file could execute arbitrary code on a vulnerable system. The attacker-supplied code would be executed with the privileges of the user opening the malicious file.
Apply a patch
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apple Computer, Inc.||Affected||-||17 Aug 2005|
CVSS Metrics (Learn More)
Thanks to Apple Product Security for reporting this vulnerability.
This document was written by Chad Dougherty based on information supplied by Apple.
- CVE IDs: CAN-2005-2502
- Date Public: 15 Aug 2005
- Date First Published: 17 Aug 2005
- Date Last Updated: 17 Aug 2005
- Severity Metric: 15.49
- Document Revision: 10
If you have feedback, comments, or additional information about this vulnerability, please send us email.