Apple Font Book Can Be Crashed By Specially Crafted Font Collections
|
|
SecurityTracker Alert ID: 1014608
|
|
SecurityTracker URL: http://securitytracker.com/id?1014608
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 2 2005
|
Impact: Denial of service via network
|
Exploit Included: Yes
|
Description: A vulnerability was reported in Apple Font Book. A remote user may be able to cause a target user's application to crash.
A remote user can create a specially named collection of fonts. When the collection is added by the target user, the Font Book application
will crash on the target system.
A long string of characters can trigger the flaw.
new.security at gmail.com reported this
vulnerability.
|
Impact: A user can create a specially crafted font "collection" that will crash the target user's Font Book application.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.apple.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (Mac OS X)
|
Reported By: new.security@gmail.com
|
Message History:
None.
|
Source Message Contents
|
Date: 31 Jul 2005 02:25:40 -0000
From: new.security@gmail.com
Subject: font book crash os x
|
font book allows users to add new "collections" of fonts with a name of thier choice. When
the name of the collection is a very very
very large string of characters it crashes. here is the gdb output:
_____________________________________________________________
(gdb) run
Starting program: /Applications/Font Book.app/Contents/MacOS/Font Book
Reading symbols for shared libraries ................................................................
........... done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xf00f0070
[Switching to process 5539 thread 0x4103]
0x9285a784 in -[NSString(NSPathUtilities) stringByAppendingPathExtension:] ()
(gdb)
__________________________________________________
for this to crash the collection name must contain thousands of characters.
|
|
