Info

Disclosure

Jan 14, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

A local overflow exists in Mac OS X. The Appletalk protocol fails to validate user input passed to the _ATPsndrsp() function resulting in a heap overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified

Solution

Upgrade to version 10.4.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Apple Computer, Inc.

Mac OS X

10.4.8

References

Security Tracker: 1017513
CVE ID: 2007-0236 (see also: NVD)
Bugtraq ID: 22041
Secunia Advisory ID: 23708
SCIP VulDB ID: 2834
Exploit Database: 3130
Milw0rm: 3130
VUPEN Advisory: ADV-2007-0191
Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=305214
Other Advisory URL: http://projects.info-pull.com/moab/MOAB-14-01-2007.html

Credit

LMH - lmhinfo-pull.com -

Direct URL: http://osvdb.org/32687