lulz ... nice find<br><br>maybe Gadi Evron can publish his first exploit now<br><br><div class="gmail_quote">On Dec 18, 2007 12:25 PM, iDefense Labs <<a href="mailto:labs-no-reply@idefense.com">labs-no-reply@idefense.com
</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">iDefense Security Advisory 12.17.07<br><a href="http://labs.idefense.com/intelligence/vulnerabilities/" target="_blank">
http://labs.idefense.com/intelligence/vulnerabilities/</a><br>Dec 17, 2007<br><br>I. BACKGROUND<br><br>The mount_smbfs utility is used to mount a remote SMB share locally. It<br>is installed set-uid root, so as to allow unprivileged users to mount
<br>shares, and is present in a default installation on both the Server and<br>Desktop versions of Mac OS X. For more information visit the following<br>URL.<br><br><a href="http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/mount_smbfs.8.html" target="_blank">
http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/mount_smbfs.8.html</a><br><br>II. DESCRIPTION<br><br>Local exploitation of a stack based buffer overflow vulnerability in<br>Apple Inc.'s Mac OS X mount_smbfs utility could allow an attacker to
<br>execute arbitrary code with root privileges.<br><br>The vulnerability exists in a portion of code responsible for parsing<br>command line arguments. When processing the -W option, which is used to<br>specify a workgroup name, the option's argument is copied into a fixed
<br>sized stack buffer without any checks on its length. This leads to a<br>trivially exploitable stack based buffer overflow.<br><br>III. ANALYSIS<br><br>Exploitation of this vulnerability results in the execution of arbitrary
<br>code with root privileges. In order to exploit this vulnerability, an<br>attacker must have execute permission for the set-uid root mount_smbfs<br>binary.<br><br>IV. DETECTION<br><br>iDefense has confirmed the existence of this vulnerability in Mac OS X
<br>version 10.4.10, on both the Server and Desktop versions. Previous<br>versions may also be affected.<br><br>V. WORKAROUND<br><br>Removing the set-uid bit from the mount_smbfs binary will prevent<br>exploitation. However, non-root users will be unable to use the
<br>program.<br><br>VI. VENDOR RESPONSE<br><br>Apple addressed this vulnerability within their Mac OS X 2007-009<br>security update. More information is available at the following URL.<br><br><a href="http://docs.info.apple.com/article.html?artnum=307179" target="_blank">
http://docs.info.apple.com/article.html?artnum=307179</a><br><br>VII. CVE INFORMATION<br><br>The Common Vulnerabilities and Exposures (CVE) project has assigned the<br>name CVE-2007-3876 to this issue. This is a candidate for inclusion in
<br>the CVE list (<a href="http://cve.mitre.org/" target="_blank">http://cve.mitre.org/</a>), which standardizes names for<br>security problems.<br><br>VIII. DISCLOSURE TIMELINE<br><br>07/16/2007 Initial vendor notification
<br>07/17/2007 Initial vendor response<br>12/17/2007 Coordinated public disclosure<br><br>IX. CREDIT<br><br>This vulnerability was discovered by Sean Larsson of VeriSign iDefense<br>Labs.<br><br>Get paid for vulnerability research
<br><a href="http://labs.idefense.com/methodology/vulnerability/vcp.php" target="_blank">http://labs.idefense.com/methodology/vulnerability/vcp.php</a><br><br>Free tools, research and upcoming events<br><a href="http://labs.idefense.com/" target="_blank">
http://labs.idefense.com/</a><br><br>X. LEGAL NOTICES<br><br>Copyright © 2007 iDefense, Inc.<br><br>Permission is granted for the redistribution of this alert<br>electronically. It may not be edited in any way without the express
<br>written consent of iDefense. If you wish to reprint the whole or any<br>part of this alert in any other medium other than electronically,<br>please e-mail <a href="mailto:customerservice@idefense.com">customerservice@idefense.com
</a> for permission.<br><br>Disclaimer: The information in the advisory is believed to be accurate<br>at the time of publishing based on currently available information. Use<br>of the information constitutes acceptance for use in an AS IS condition.
<br> There are no warranties with regard to this information. Neither the<br>author nor the publisher accepts any liability for any direct,<br>indirect, or consequential loss or damage arising from use of, or<br>reliance on, this information.
<br><br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html
</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank">http://secunia.com/</a><br></blockquote></div><br>