SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Instant Messaging/IRC/Chat)  >   iChat Vendors:   Apple Computer
Apple iChat Format String Bug Lets Remote Users Execute Arbitrary Code and Null Pointer Dereference Lets Remote Users Deny Service
SecurityTracker Alert ID:  1017661
SecurityTracker URL:  http://securitytracker.com/id/1017661
CVE Reference:   CVE-2007-0021, CVE-2007-0614, CVE-2007-0710   (Links to External Site)
Date:  Feb 16 2007
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Several vulnerabilities were reported in iChat. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions.

A remote user on the local network can create a specially crafted Bonjour message to trigger a null pointer dereference and cause the target iChat application to crash [CVE-2007-0614, CVE-2007-0710].

The original advisory is available at:

http://projects.info-pull.com/moab/MOAB-29-01-2007.html

A remote user can create a specially crafted AIM URL that, when loaded by the target user, will trigger a format string flaw and cause the iChat application to crash or execute arbitrary code [CVE-2007-0021].

The original advisory is available at:

http://projects.info-pull.com/moab/MOAB-20-01-2007.html

LMH discovered these vulnerabilities.

Impact:   A remote user can execute arbitrary code on the target system.

A remote user can cause denial of service conditions.

Solution:   Apple has released a fix as part of Security Update 2007-002, available from the Software Update pane in System Preferences, or Apple's Software Downloads web site at:

http://www.apple.com/support/downloads/

For Mac OS X v10.4.8 (PowerPC)
The download file is named: "SecUpd2007-002Ti.dmg"
Its SHA-1 digest is: 79da4e0f61288277f9896e761903abf748d2dc21

For Mac OS X v10.4.8 (Intel)
The download file is named: "SecUpd2007-002Univ.dmg"
Its SHA-1 digest is: 9a4b97853ac05ff407a8b8fe0906d916e219648b

For Mac OS X v10.3.9
The download file is named: "SecUpd2007-002Pan.dmg"
Its SHA-1 digest is: 81199248bf7218d8788663153131ab51d31320a1

The Apple advisory is available at:

http://docs.info.apple.com/article.html?artnum=305102

Vendor URL:  docs.info.apple.com/article.html?artnum=305102 (Links to External Site)
Cause:   Boundary error, Input validation error, State error
Underlying OS:   UNIX (OS X)

Message History:   None.


 Source Message Contents

Date:  Thu, 15 Feb 2007 09:15:22 -0800
Subject:  APPLE-SA-2007-02-15 Security Update 2007-002

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2007-02-15 Security Update 2007-002

Security Update 2007-002 is now available and addresses the following
issues:

Finder
CVE-ID:  CVE-2007-0197
Available for:  Mac OS X v10.4.8, Mac OS X Server v10.4.8
Impact:  Mounting a maliciously-crafted disk image may lead to an
application crash or arbitrary code execution
Description:  A buffer overflow exists in Finder's handling of
volume names. By enticing a user to mount a malicious disk
image, an attacker could trigger this issue, which may lead to
an application crash or arbitrary code execution. A proof of
concept for this issue has been published on the Month of Apple
Bugs web site (MOAB-09-01-2007). This update addresses the issue
by performing additional validation of disk images. This issue
does not affect systems prior to Mac OS X v10.4. Credit to Kevin
Finisterre of DigitalMunition for reporting this issue.

iChat
CVE-ID:  CVE-2007-0614, CVE-2007-0710
Available for:  Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS
X v10.4.8, Mac OS X Server v10.4.8
Impact:  Attackers on the local network may be able to cause
iChat to crash
Description:  A null pointer dereference in iChat's Bonjour
message handling could allow a local network attacker to cause
an application crash. A proof of concept for this issue in Mac
OS X v10.4 has been published on the Month of Apple Bugs web
site (MOAB-29-01-2007). This update addresses the issues by
performing additional validation of Bonjour messages.

iChat
CVE-ID:  CVE-2007-0021
Available for:  Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS
X v10.4.8, Mac OS X Server v10.4.8
Impact:  Visiting malicious websites may lead to an application
crash or arbitrary code execution
Description:  A format string vulnerability exists in the iChat
AIM URL handler. By enticing a user to access a maliciously-crafted
AIM URL, an attacker can trigger the overflow, which may lead to an
application crash or arbitrary code execution. A proof of concept for
this issue has been published on the Month of Apple Bugs web site
(MOAB-20-01-2007). This update addresses the issue by performing
additional validation of AIM URLs.

UserNotification
CVE-ID:  CVE-2007-0023
Available for:  Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS
X v10.4.8, Mac OS X Server v10.4.8
Impact:  Malicious local users may be able to obtain system
privileges
Description:  The UserNotificationCenter process runs with
elevated privileges in the context of a local user. This may
allow a malicious local user to overwrite or modify system
files. A program that triggers this issue has been published on
the Month of Apple Bugs web site (MOAB-22-01-2007). This update
addresses the issue by having UserNotificationCenter drop its
group privileges immediately after launching.

Security Update 2007-002 may be obtained from the Software Update
pane in System Preferences, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/

For Mac OS X v10.4.8 (PowerPC)
The download file is named:  "SecUpd2007-002Ti.dmg"
Its SHA-1 digest is:  79da4e0f61288277f9896e761903abf748d2dc21

For Mac OS X v10.4.8 (Intel)
The download file is named:  "SecUpd2007-002Univ.dmg"
Its SHA-1 digest is:  9a4b97853ac05ff407a8b8fe0906d916e219648b

For Mac OS X v10.3.9
The download file is named:  "SecUpd2007-002Pan.dmg"
Its SHA-1 digest is:  81199248bf7218d8788663153131ab51d31320a1

Information will also be posted to the Apple Product Security
web site:
http://docs.info.apple.com/article.html?artnum=61798

This message is signed with Apple's Product Security PGP key,
and details are available at:
http://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.3 (Build 2932)

iQEVAwUBRdSUVYmzP5/bU5rtAQhWywgAn97GfRUyIFuBPsx37RNG1XCo5swnVY3u
agGCzAyXtEj5D/AiyVzPLrT5Lmb2I78grI6wJDocB5k8g1HCQQsvJoMneN1iAtMH
ekwyicx5ZP0Fwh/JYBIQjcWgpVm5S5cA+A4ZOjsODU0xT+jl9SxjVZe62y95eTF0
fK/LNvKQkxpUYHbAJ5mU9JC8dUQ/m9dGlHt3nRM82or0zJNxSa3YvhSLaEXs2HBF
Zynt4xfrFXFuw9YJR2R+K7CsDypTbCbN+oL0cp4RfFdJVfZ3RVIZrCDKGjXElP3y
3tmAaP6NXJ7A1YK5jB+k30l2N+dh5yDW27AdH/17IBScUvYiauBpmQ==
=duIn
-----END PGP SIGNATURE-----

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list      (Security-announce@lists.apple.com)
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC