Description
Integer overflow in the ffs_mountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to CVE-2006-5679. NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apple Mac OSX 10.4.8 - DMG UFS FFS_MountFS Integer Overflow EDB-29441 · dos · Jan 10, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://projects.info-pull.com/moab/MOAB-10-01-2007.html
- TA07-072A third-party-advisory
- 32684 vdb-entry
- [freebsd-security] 20070114 MOAB advisories mailing-list
- ADV-2007-0141 vdb-entry
- APPLE-SA-2007-03-13 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- 1017751 vdb-entry
- 21993 vdb-entry
- macos-ffsmountfs-bo(31409) vdb-entry
- 23703 third-party-advisory
- http://applefun.blogspot.com/2007/01/moab-10-01-2007-apple-dmg-ufs.html
- ADV-2007-0930 vdb-entry
- 24479 third-party-advisory