SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#529945

Apple Mac OS X QuickDraw Manager fails to properly handle corrupt PICT files

Overview

Apple Mac OS X QuickDraw Manager contains a buffer overflow that may allow a remote attacker to execute arbitrary code.

I. Description

Apple Mac OS X QuickDraw is a 2D graphics library. It is used by several applications, including Safari, Mail, and Finder. QuickDraw is used to render PICT images on Mac systems. QuickDraw Manager contains an unspecified buffer overflow in the handling of PICT images.

II. Impact

By convincing a user to view a specially crafted PICT image (e.g., contained within a web page or an HTML email message), an attacker could execute arbitrary code with the privileges of the user. The attacker could also cause the application using the QuickDraw library to crash.

III. Solution

Apply an update

Please see Apple Security Update 2005-008 for details on workarounds, fixes, and updates.

Systems Affected

VendorStatusDate NotifiedDate Updated
Apple Computer, Inc.Vulnerable27-Sep-2005

References


http://docs.info.apple.com/article.html?artnum=302413
http://developer.apple.com/documentation/Carbon/Reference/QuickDraw_Ref/index.html
http://developer.apple.com/documentation/mac/QuickDraw/QuickDraw-333.html#HEADING333-29
http://www.auscert.org.au/5509
http://securitytracker.com/alerts/2005/Sep/1014961.html
http://www.securityfocus.com/bid/14914
http://secunia.com/advisories/16920/
http://xforce.iss.net/xforce/xfdb/22384
http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33420

Credit

Thanks to Apple Product Security for reporting this vulnerability, who in turn credit Henrik Dalgaard of Echo One.

This document was written by Will Dormann.

Other Information

Date Public:2005-09-21
Date First Published:2005-09-27
Date Last Updated:2005-09-27
CERT Advisory: 
CVE-ID(s):CAN-2005-2744
NVD-ID(s):CAN-2005-2744
US-CERT Technical Alerts: 
Metric:28.69
Document Revision:9

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader