var-200505-0311
Vulnerability from variot
Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument. An integer overflow in LibTIFF may allow a remote attacker to execute arbitrary code. The vulnerability presents itself when the application handles excessive string values supplied through the '-i' command line parameter. An attacker can gain superuser privileges by exploiting this issue. Due to the availability of more information, this issue is being assinged a new BID.
Want a new IT Security job?
Vacant positions at Secunia: http://secunia.com/secunia_vacancies/
TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA15227
VERIFY ADVISORY: http://secunia.com/advisories/15227/
CRITICAL: Highly critical
IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, System access
WHERE:
From remote
OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/
DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes various vulnerabilities.
1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument.
NOTE: htdigest is by default only locally accessible and not setuid / setgid.
2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system.
For more information: SA13607
3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application.
4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run.
5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly.
6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services.
7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges.
8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files.
For more information: SA14188
9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code.
10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions.
11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text.
12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system.
For more information: SA12549
13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction.
14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system.
15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service.
16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges.
For more information: SA13199
17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles.
18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs.
SOLUTION: Apply Security Update 2005-005.
Security Update 2005-005 (Client): http://www.apple.com/support/downloads/securityupdate2005005client.html
Security Update 2005-005 (Server): http://www.apple.com/support/downloads/securityupdate2005005server.html
PROVIDED AND/OR DISCOVERED BY: 1) JxT 3) Henrik Dalgaard 4) David Remahl 5) Kevin Finisterre, digitalmunition.com. 6) Kevin Finisterre, digitalmunition.com. 10) David Remahl 13) Rob Griffiths 14) Nico 17) David Remahl 18) David Remahl 19) Pieter de Boer
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=301528
David Remahl: http://remahl.se/david/vuln/004/ http://remahl.se/david/vuln/010/ http://remahl.se/david/vuln/011/ http://remahl.se/david/vuln/012/
digitalmunition.com: http://www.digitalmunition.com/DMA[2005-0502a].txt
iDEFENSE: http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities
OTHER REFERENCES: SA12549: http://secunia.com/advisories/12549/
SA13199: http://secunia.com/advisories/13199/
SA13607: http://secunia.com/advisories/13607/
SA14188: http://secunia.com/advisories/14188/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This bug can be easily exploited to gain root access. This vulnerability has CVE ID CAN-2005-1343.
Exploitation
The overflow can only be exploited on a system having vpnd configured as a server. The following shows a NON-exploitable vpnd installation:
host:/tmp root# vpnd -i bla 2005-05-04 15:12:54 CEST VPND: could not get servers dictionary 2005-05-04 15:12:54 CEST VPND: error processing prefs file
This is due to the non-existance of /var/db/SystemConfiguration/com.apple.RemoteAccessServers.plist.
Anyway, on an exploitable system you'd get:
host:/tmp root# vpnd -i perl -e 'print "A"x600'
2005-05-04 15:16:41 CEST VPND: Server ID 'AAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
invalid
Segmentation fault
The crashlog /Library/Logs/CrashReporter/vpnd.crash.log shows:
OS Version: 10.3.7 (Build 7S215) Report Version: 2 Command: vpnd Path: /usr/sbin/vpnd Version: ??? (???) PID: 12690 Thread: 0
Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0x41414140
Thread 0 Crashed:
PPC Thread State: srr0: 0x41414140 srr1: 0x4200f030 vrsave: 0x00000000 cr: 0x24000242 xer: 0x00000004 lr: 0x41414141 ctr: 0x900010a0 r0: 0x41414141 r1: 0xbffffbf0 r2: 0xa0192b50 r3: 0xffffffff r4: 0x00300950 r5: 0x00402004 r6: 0x00402004 r7: 0x00000001 r8: 0x0000000f r9: 0xa00011ac r10: 0x00000013 r11: 0x44000244 r12: 0x900010a0 r13: 0x00000000 r14: 0x00000000 r15: 0x00000000 r16: 0x00000000 r17: 0x00000000 r18: 0x00000000 r19: 0x00000000 r20: 0x00000000 r21: 0x00000000 r22: 0x00000000 r23: 0x00000000 r24: 0x00000000 r25: 0x00000000 r26: 0xbffffce4 r27: 0x00000014 r28: 0x41414141 r29: 0x41414141 r30: 0x41414141 r31: 0x41414141
Fix
Apply Security Update 2005-005 (which fixes quite a few other bugs, too), remove the suid bit or remove the above mentioned config file
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200505-0311",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": null,
"scope": null,
"trust": 3.2,
"vendor": "apple computer",
"version": null
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.3.9"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.3.9"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "red hat",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "BID",
"id": "13488"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pieter de Boer pieter@os3.nl",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
}
],
"trust": 0.6
},
"cve": "CVE-2005-1343",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2005-1343",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-12552",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2005-1343",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#356070",
"trust": 0.8,
"value": "22.31"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#539110",
"trust": 0.8,
"value": "5.04"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#706838",
"trust": 0.8,
"value": "9.38"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#331694",
"trust": 0.8,
"value": "15.94"
},
{
"author": "CNNVD",
"id": "CNNVD-200505-868",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-12552",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-12552"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument. An integer overflow in LibTIFF may allow a remote attacker to execute arbitrary code. \nThe vulnerability presents itself when the application handles excessive string values supplied through the \u0027-i\u0027 command line parameter. \nAn attacker can gain superuser privileges by exploiting this issue. Due to the availability of more information, this issue is being assinged a new BID. \n\n----------------------------------------------------------------------\n\nWant a new IT Security job?\n\nVacant positions at Secunia:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nMac OS X Security Update Fixes Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA15227\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/15227/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Spoofing, Exposure of sensitive information,\nPrivilege escalation, System access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple Macintosh OS X\nhttp://secunia.com/product/96/\n\nDESCRIPTION:\nApple has issued a security update for Mac OS X, which fixes various\nvulnerabilities. \n\n1) A boundary error in htdigest can be exploited to cause a buffer\noverflow by passing an overly long realm argument. \n\nNOTE: htdigest is by default only locally accessible and not setuid /\nsetgid. \n\n2) An integer overflow error in the AppKit component when processing\nTIFF files can be exploited by malicious people to compromise a\nuser\u0027s system. \n\nFor more information:\nSA13607\n\n3) An error in the AppKit component when parsing certain TIFF images\ncan result in an invalid call to the \"NXSeek()\" function, which will\ncrash an affected Cocoa application. \n\n4) An error within the handling of AppleScript can be exploited to\ndisplay code to a user that is different than the code, which will\nactually run. \n\n5) An error in the Bluetooth support may cause Bluetooth-enabled\nsystems to share files via the Bluetooth file exchange service\nwithout notifying the user properly. \n\n6) An input validation error can be exploited to access arbitrary\nfiles on a Bluetooth-enabled system using directory traversal attacks\nvia the Bluetooth file and object exchange services. \n\n7) The chfn, chpass, and chsh utilities invoke certain external\nhelper programs insecurely, which can be exploited by malicious,\nlocal users to gain escalated privileges. \n\n8) A vulnerability in Finder can be exploited by malicious, local\nusers to perform certain actions on a vulnerable system with\nescalated privileges due to insecure creation of \".DS_Store\" files. \n\nFor more information:\nSA14188\n\n9) A boundary error within the Foundation framework when handling\nenvironment variables can be exploited to cause a buffer overflow and\nmay allow execution of arbitrary code. \n\n10) An error in Help Viewer can be exploited to run JavaScript\nwithout the normally imposed security restrictions. \n\n11) A security issue in the LDAP functionality may under certain\ncircumstances result in passwords initially being stored in plain\ntext. \n\n12) Errors within the parsing of XPM files can potentially be\nexploited by malicious people to compromise a vulnerable system. \n\nFor more information:\nSA12549\n\n13) An error in lukemftpd can be exploited by malicious users to\nbypass chroot restrictions. In order to restrict users to their home\ndirectory, both their full name and short name must be listed in the\n\"/etc/ftpchroot\" file. However, the problem is that users can change\ntheir full name and thereby bypass this restriction. \n\n14) A boundary error in the Netinfo Setup Tool (NeST) when processing\ninput passed to the \"-target\" command line parameter can be exploited\nby malicious, local users to cause a buffer overflow and execute\narbitrary code with escalated privileges on a vulnerable system. \n\n15) When enabling the HTTP proxy service in Server Admin, it is by\ndefault possible for everyone (including users on the Internet) to\nuse the proxy service. \n\n16) A vulnerability in sudo within the environment clearing can be\nexploited by malicious, local users to gain escalated privileges. \n\nFor more information:\nSA13199\n\n17) An error in the Terminal utility can be exploited to inject data\nvia malicious input containing escape sequences in window titles. \n\n18) An error in the Terminal utility can be exploited to inject\ncommands into a user\u0027s Terminal session via malicious input\ncontaining escape characters in x-man-path URIs. \n\nSOLUTION:\nApply Security Update 2005-005. \n\nSecurity Update 2005-005 (Client):\nhttp://www.apple.com/support/downloads/securityupdate2005005client.html\n\nSecurity Update 2005-005 (Server):\nhttp://www.apple.com/support/downloads/securityupdate2005005server.html\n\nPROVIDED AND/OR DISCOVERED BY:\n1) JxT\n3) Henrik Dalgaard\n4) David Remahl\n5) Kevin Finisterre, digitalmunition.com. \n6) Kevin Finisterre, digitalmunition.com. \n10) David Remahl\n13) Rob Griffiths\n14) Nico\n17) David Remahl\n18) David Remahl\n19) Pieter de Boer\n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=301528\n\nDavid Remahl:\nhttp://remahl.se/david/vuln/004/\nhttp://remahl.se/david/vuln/010/\nhttp://remahl.se/david/vuln/011/\nhttp://remahl.se/david/vuln/012/\n\ndigitalmunition.com:\nhttp://www.digitalmunition.com/DMA[2005-0502a].txt\n\niDEFENSE:\nhttp://www.idefense.com/application/poi/display?id=239\u0026type=vulnerabilities\n\nOTHER REFERENCES:\nSA12549:\nhttp://secunia.com/advisories/12549/\n\nSA13199:\nhttp://secunia.com/advisories/13199/\n\nSA13607:\nhttp://secunia.com/advisories/13607/\n\nSA14188:\nhttp://secunia.com/advisories/14188/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This bug can be easily exploited to\ngain root access. \nThis vulnerability has CVE ID CAN-2005-1343. \n\n\nExploitation\n------------\n\nThe overflow can only be exploited on a system having vpnd configured as\na server. The following shows a NON-exploitable vpnd installation:\n\nhost:/tmp root# vpnd -i bla\n2005-05-04 15:12:54 CEST VPND: could not get servers dictionary\n2005-05-04 15:12:54 CEST VPND: error processing prefs file\n\nThis is due to the non-existance of\n/var/db/SystemConfiguration/com.apple.RemoteAccessServers.plist. \n\n\nAnyway, on an exploitable system you\u0027d get:\n\nhost:/tmp root# vpnd -i `perl -e \u0027print \"A\"x600\u0027`\n2005-05-04 15:16:41 CEST VPND: Server ID \u0027AAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0027\ninvalid\nSegmentation fault\n\n\nThe crashlog /Library/Logs/CrashReporter/vpnd.crash.log shows:\n\nOS Version: 10.3.7 (Build 7S215)\nReport Version: 2\nCommand: vpnd\nPath: /usr/sbin/vpnd\nVersion: ??? (???)\nPID: 12690\nThread: 0\n\nException: EXC_BAD_ACCESS (0x0001)\nCodes: KERN_INVALID_ADDRESS (0x0001) at 0x41414140\n\nThread 0 Crashed:\n\nPPC Thread State:\n srr0: 0x41414140 srr1: 0x4200f030 vrsave: 0x00000000\n cr: 0x24000242 xer: 0x00000004 lr: 0x41414141 ctr: 0x900010a0\n r0: 0x41414141 r1: 0xbffffbf0 r2: 0xa0192b50 r3: 0xffffffff\n r4: 0x00300950 r5: 0x00402004 r6: 0x00402004 r7: 0x00000001\n r8: 0x0000000f r9: 0xa00011ac r10: 0x00000013 r11: 0x44000244\n r12: 0x900010a0 r13: 0x00000000 r14: 0x00000000 r15: 0x00000000\n r16: 0x00000000 r17: 0x00000000 r18: 0x00000000 r19: 0x00000000\n r20: 0x00000000 r21: 0x00000000 r22: 0x00000000 r23: 0x00000000\n r24: 0x00000000 r25: 0x00000000 r26: 0xbffffce4 r27: 0x00000014\n r28: 0x41414141 r29: 0x41414141 r30: 0x41414141 r31: 0x41414141\n\n\nFix\n---\n\nApply Security Update 2005-005 (which fixes quite a few other bugs,\ntoo), remove the suid bit or remove the above mentioned config file",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-1343"
},
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "BID",
"id": "13488"
},
{
"db": "VULHUB",
"id": "VHN-12552"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "PACKETSTORM",
"id": "39081"
}
],
"trust": 4.32
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-12552",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-12552"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "SECUNIA",
"id": "15227",
"trust": 3.3
},
{
"db": "CERT/CC",
"id": "VU#706838",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2005-1343",
"trust": 2.1
},
{
"db": "USCERT",
"id": "TA05-136A",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "16084",
"trust": 0.8
},
{
"db": "BID",
"id": "13502",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#356070",
"trust": 0.8
},
{
"db": "SECTRACK",
"id": "1012651",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "13607",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#539110",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "16085",
"trust": 0.8
},
{
"db": "SECTRACK",
"id": "1013887",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "16075",
"trust": 0.8
},
{
"db": "XF",
"id": "20376",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#331694",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868",
"trust": 0.7
},
{
"db": "APPLE",
"id": "APPLE-SA-2005-05-03",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2005-06-08",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA05-136A",
"trust": 0.6
},
{
"db": "BID",
"id": "13488",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "39081",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-12552",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "37530",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-12552"
},
{
"db": "BID",
"id": "13488"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "PACKETSTORM",
"id": "39081"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"id": "VAR-200505-0311",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-12552"
}
],
"trust": 0.01
},
"last_update_date": "2024-09-19T22:11:51.488000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://secunia.com/advisories/15227/"
},
{
"trust": 2.6,
"url": "http://docs.info.apple.com/article.html?artnum=301528"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2005/may/msg00001.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2005/jun/msg00000.html"
},
{
"trust": 1.7,
"url": "http://www.us-cert.gov/cas/techalerts/ta05-136a.html"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/706838"
},
{
"trust": 0.9,
"url": "http://remahl.se/david/vuln/011/"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/13607/"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/13502/"
},
{
"trust": 0.8,
"url": "http://www.osvdb.org/displayvuln.php?osvdb_id=16084"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/alerts/2004/dec/1012651.html"
},
{
"trust": 0.8,
"url": "http://www.idefense.com/application/poi/display?id=173\u0026type=vulnerabilities"
},
{
"trust": 0.8,
"url": "http://www.idefense.com/application/poi/display?id=240\u0026type=vulnerabilities"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.org/bid/13488"
},
{
"trust": 0.8,
"url": "http://www.securitytracker.com/alerts/2005/may/1013887.html"
},
{
"trust": 0.8,
"url": "http://www.osvdb.org/displayvuln.php?osvdb_id=16085"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/20376"
},
{
"trust": 0.8,
"url": "http://www.apple.com/server/macosx/"
},
{
"trust": 0.8,
"url": "http://www.osvdb.org/16075"
},
{
"trust": 0.3,
"url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?type=vulnerabilities\u0026id=240"
},
{
"trust": 0.3,
"url": "http://www.apple.com"
},
{
"trust": 0.1,
"url": ""
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate2005005server.html"
},
{
"trust": 0.1,
"url": "http://www.digitalmunition.com/dma[2005-0502a].txt"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/010/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/012/"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/004/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate2005005client.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/application/poi/display?id=239\u0026type=vulnerabilities"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/14188/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/12549/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/96/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/13199/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2005-1343"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-12552"
},
{
"db": "BID",
"id": "13488"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "PACKETSTORM",
"id": "39081"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#706838"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-12552"
},
{
"db": "BID",
"id": "13488"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "PACKETSTORM",
"id": "39081"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-05-06T00:00:00",
"db": "CERT/CC",
"id": "VU#356070"
},
{
"date": "2005-01-20T00:00:00",
"db": "CERT/CC",
"id": "VU#539110"
},
{
"date": "2005-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#706838"
},
{
"date": "2005-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#331694"
},
{
"date": "2005-05-03T00:00:00",
"db": "VULHUB",
"id": "VHN-12552"
},
{
"date": "2005-05-03T00:00:00",
"db": "BID",
"id": "13488"
},
{
"date": "2005-05-29T20:22:44",
"db": "PACKETSTORM",
"id": "37530"
},
{
"date": "2005-08-06T06:41:23",
"db": "PACKETSTORM",
"id": "39081"
},
{
"date": "2005-05-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"date": "2005-05-03T04:00:00",
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#356070"
},
{
"date": "2005-08-23T00:00:00",
"db": "CERT/CC",
"id": "VU#539110"
},
{
"date": "2005-05-24T00:00:00",
"db": "CERT/CC",
"id": "VU#706838"
},
{
"date": "2005-05-25T00:00:00",
"db": "CERT/CC",
"id": "VU#331694"
},
{
"date": "2008-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-12552"
},
{
"date": "2009-07-12T14:06:00",
"db": "BID",
"id": "13488"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200505-868"
},
{
"date": "2008-09-05T20:48:53.827000",
"db": "NVD",
"id": "CVE-2005-1343"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "13488"
},
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Terminal fails to properly sanitize input for \"x-man-page\" URI",
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200505-868"
}
],
"trust": 0.6
}
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.