OSVDB ID: 25586

Title: Apple Mac OS X CoreFoundation Untrusted Bundle Arbitrary Code Execution

Info

Disclosure

May 08, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Mac OS X contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when CoreFoundation registers an untrusted bundle without user interaction. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

Classification

Location: Local Access Required
Attack Type: Other
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

Install Apple Security Update 2006-003, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Apple Computer, Inc.	Mac OS X	10.3.x
		10.4
		10.4.1
		10.4.2
		10.4.3
		10.4.4
		10.4.5
		10.4.6

References

Security Tracker: 1016080
Bugtraq ID: 17951
CVE ID: 2006-1442 (see also: NVD)
Secunia Advisory ID: 20077
Related OSVDB ID: 25583 25584 25585 25587 25588 25590 25591 25592 25593 25594 25595 25596 25597 25598 25599 25600
VUPEN Advisory: ADV-2006-1779
Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=303737
CERT: TA06-132A

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/25586

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Apple Computer, Inc.

Mac OS X

References

Credit