Description
Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER line, or (2) a large integer in a COUNT field on an RRULE line.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Apple iCal 3.0.1 - 'COUNT' Integer Overflow EDB-31613 · remote · Apr 21, 2008 · verified
- Apple iCal 3.0.1 - 'TRIGGER' Denial of Service EDB-31619 · dos · Apr 21, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2008-1601 vdb-entry
- ical-trigger-dos(42569) vdb-entry
- 28632 vdb-entry
- http://www.coresecurity.com/?action=item&id=2219
- 20080528 Re: CORE-2008-0126: Multiple vulnerabilities in iCal mailing-list
- 20080527 Re: CORE-2008-0126: Multiple vulnerabilities in iCal mailing-list
- 3901 third-party-advisory
- 1020094 vdb-entry
- 28629 vdb-entry
- 20080521 CORE-2008-0126: Multiple vulnerabilities in iCal mailing-list