search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Apple Mac OS X AppKit vulnerable to buffer overflow via maliciously crafted Microsoft Word files

Vulnerability Note VU#172948

Original Release Date: 2005-08-17 | Last Revised: 2005-08-17

Overview

A buffer overflow vulnerability exists in a component of Apple's Mac OS X operating system that handles Microsoft Word files.

Description

The Cocoa Application Framework (also referred to as the Application Kit, or AppKit) is one of the core Cocoa frameworks supplied with Apple's Mac OS X operating system. It provides functionality and associated Application Program Interfaces (APIs) for applications, including objects for graphical user interfaces (GUIs), event-handling mechanisms, application services, and drawing and image composition facilities.

A buffer overflow exists in the AppKit component designed to handle Microsoft Word (.doc) files. Apple notes in its security advisory that this vulnerability only affects applications that use AppKit (such as TextEdit) and that Microsoft Word for Mac OS X is not vulnerable. A maliciously crafted .doc file could be used to execute arbitrary code on a vulnerable system.

Impact

An attacker with the ability to supply a maliciously crafted Microsoft Word .doc file could execute arbitrary code on a vulnerable system. The attacker-supplied code would be executed with the privileges of the user opening the malicious file.

Solution

Apply a patch

Apple has released a patch to address this issue and other security issues in Security Update 2005-007. Users are encouraged to apply the patches from this update.

Vendor Information

172948
 
Affected   Unknown   Unaffected

Apple Computer, Inc.

Updated:  August 17, 2005

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Apple has released a patch to address this issue and other security issues in Security Update 2005-007. Users are encouraged to apply the patches from this update.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to Apple Product Security for reporting this vulnerability.

This document was written by Chad Dougherty based on information supplied by Apple.

Other Information

CVE IDs: CVE-2005-2502
Severity Metric: 15.49
Date Public: 2005-08-15
Date First Published: 2005-08-17
Date Last Updated: 2005-08-17 17:47 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.