Vulnerability Note VU#878526

Apple Mac OS X "cd9660.util" buffer overflow

Overview

A component utility in Apple's Mac OS X operating system suffers from a buffer overflow vulnerability in its handling of command-line arguments. This vulnerability could allow a local attacker to gain elevated privileges on the vulnerable system.

I. Description

Apple's Mac OS X operating system includes a program for mounting, probing, and unmounting ISO 9660 filesystems called cd9660.util (/System/Library/Filesystems/cd9660.fs/cd9660.util). A buffer overflow defect exists in the handling of the argument supplied to the '-p' option of this program. An overly long, specially crafted string supplied on the command-line may allow an attacker to execute code of their choosing on the system. The intruder-supplied code would be executed as the root user since the cd9660.util program is setuid to root by default.

II. Impact

A local attacker may be able to gain administrative (root) privileges on the vulnerable system.

III. Solution

Apply a patch from the vendor

Apple Computer, Inc. has released patches for this vulnerability. Please see the Systems Affected section of this document for more details.

Workarounds

Remove the setuid permission from the cd9660.util program. This can be accomplished by executing the following command:

chmod u-s /System/Library/Filesystems/cd9660.fs/cd9660.util

as root. Users, particularly those that are not able to apply the patches, are encouraged to implement this workaround.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer Inc.	Vulnerable	15-Mar-2004

References

http://www.secunia.com/advisories/10440/

Credit

The CERT/CC acknowledges "Max" for the initial public report of this vulnerability. Apple, in turn, credits KF of Secure Network Operations for discovery of this vulnerability.

This document was written by Chad R Dougherty.

Other Information

Date Public:	2003-12-15
Date First Published:	2004-03-15
Date Last Updated:	2004-03-15
CERT Advisory:
CVE-ID(s):	CAN-2003-1006
NVD-ID(s):	CAN-2003-1006
US-CERT Technical Alerts:
Metric:	7.70
Document Revision:	8

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader