Vulnerability Note VU#566875

Apple Help Viewer vulnerable to buffer overflow

Overview

A vulnerability in the way Apple Help Viewer handles specially crafted URLs may allow an attacker to execute arbitrary code or cause a denial of service.

I. Description

According to Apple Security Update 2008-003:

An integer underflow in Help Viewer's handling of help:topic URLs may result in a buffer overflow. Accessing a malicious help:topic URL may lead to an unexpected application termination or arbitrary code execution.

Note that this issue affects systems running Mac OS X prior to version 10.5.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial of service.

III. Solution

Apply Update

This issue is addressed in Apple Security Update 2008-003. An update for Mac OS X is available on Apple Downloads and via Software Update.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	29-May-2008

References

http://lists.apple.com/archives/security-announce/2008/May/msg00001.html

Credit

This issue was reported in Apple Security Update 2008-003. Apple credits Paul Haddad of PTH with reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public:	2008-05-28
Date First Published:	2008-05-29
Date Last Updated:	2008-05-29
CERT Advisory:
CVE-ID(s):	CVE-2008-1034
NVD-ID(s):	CVE-2008-1034
US-CERT Technical Alerts:
Metric:	8.68
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader