Apple Font Book Can Be Crashed By Specially Crafted Font Collections
|
|
SecurityTracker Alert ID: 1014608 |
|
SecurityTracker URL: http://securitytracker.com/id/1014608
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 2 2005
|
Impact:
Denial of service via network
|
Exploit Included: Yes
|
|
Description:
A vulnerability was reported in Apple Font Book. A remote user may be able to cause a target user's application to crash.
A remote user can create a specially named collection of fonts. When the collection is added by the target user, the Font Book application will crash on the target system.
A long string of characters can trigger the flaw.
new.security at gmail.com reported this vulnerability.
|
Impact:
A user can create a specially crafted font "collection" that will crash the target user's Font Book application.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.apple.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: 31 Jul 2005 02:25:40 -0000
Subject: font book crash os x
|
font book allows users to add new "collections" of fonts with a name of thier choice. When the name of the collection is a very very
very large string of characters it crashes. here is the gdb output:
_____________________________________________________________
(gdb) run
Starting program: /Applications/Font Book.app/Contents/MacOS/Font Book
Reading symbols for shared libraries ........................................................................... done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xf00f0070
[Switching to process 5539 thread 0x4103]
0x9285a784 in -[NSString(NSPathUtilities) stringByAppendingPathExtension:] ()
(gdb)
__________________________________________________
for this to crash the collection name must contain thousands of characters.
|
|
