ID

VAR-200412-0902


CVE

CVE-2004-1307


TITLE

Apple Terminal fails to properly sanitize input for "x-man-page" URI

Trust: 0.8

sources: CERT/CC: VU#356070

DESCRIPTION

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow. Apple Terminal on Mac OS X fails to sanitize x-man-page URIs, allowing an attacker to execute arbitrary commands. LibTIFF Library TIFFFetchStripThing() Perform memory allocation in functions CheckMalloc() An integer overflow vulnerability exists due to a flaw in the validation of the value passed to the function.LibTIFF Arbitrary code may be executed with the execution authority of the application that uses the library. ---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA15227 VERIFY ADVISORY: http://secunia.com/advisories/15227/ CRITICAL: Highly critical IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, System access WHERE: >From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/ DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. 1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument. NOTE: htdigest is by default only locally accessible and not setuid / setgid. 2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system. For more information: SA13607 3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application. 4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run. 5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly. 6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services. 7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges. 8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files. For more information: SA14188 9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code. 10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions. 11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text. 12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system. For more information: SA12549 13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction. 14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system. 15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service. 16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges. For more information: SA13199 17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles. 18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs. 19) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on systems configured as a VPN server. SOLUTION: Apply Security Update 2005-005. Security Update 2005-005 (Client): http://www.apple.com/support/downloads/securityupdate2005005client.html Security Update 2005-005 (Server): http://www.apple.com/support/downloads/securityupdate2005005server.html PROVIDED AND/OR DISCOVERED BY: 1) JxT 3) Henrik Dalgaard 4) David Remahl 5) Kevin Finisterre, digitalmunition.com. 6) Kevin Finisterre, digitalmunition.com. 10) David Remahl 13) Rob Griffiths 14) Nico 17) David Remahl 18) David Remahl 19) Pieter de Boer ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=301528 David Remahl: http://remahl.se/david/vuln/004/ http://remahl.se/david/vuln/010/ http://remahl.se/david/vuln/011/ http://remahl.se/david/vuln/012/ digitalmunition.com: http://www.digitalmunition.com/DMA[2005-0502a].txt iDEFENSE: http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities OTHER REFERENCES: SA12549: http://secunia.com/advisories/12549/ SA13199: http://secunia.com/advisories/13199/ SA13607: http://secunia.com/advisories/13607/ SA14188: http://secunia.com/advisories/14188/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.24

sources: NVD: CVE-2004-1307 // CERT/CC: VU#356070 // CERT/CC: VU#539110 // JVNDB: JVNDB-2004-000574 // VULHUB: VHN-9737 // PACKETSTORM: 37530

AFFECTED PRODUCTS

vendor:apple computermodel: - scope: - version: -

Trust: 1.6

vendor:sunmodel:solarisscope:eqversion:7.0

Trust: 1.6

vendor:sunmodel:solarisscope:eqversion:10.0

Trust: 1.6

vendor:sunmodel:solarisscope:eqversion:8.0

Trust: 1.6

vendor:avayamodel:interactive responsescope:eqversion:*

Trust: 1.0

vendor:avayamodel:intuity audix lxscope:eqversion:*

Trust: 1.0

vendor:scomodel:unixwarescope:eqversion:7.1.4

Trust: 1.0

vendor:avayamodel:cvlanscope:eqversion:*

Trust: 1.0

vendor:avayamodel:interactive responsescope:eqversion:1.3

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:9.0

Trust: 1.0

vendor:avayamodel:modular messaging message storage serverscope:eqversion:1.1

Trust: 1.0

vendor:sunmodel:solarisscope:eqversion:9.0

Trust: 1.0

vendor:avayamodel:interactive responsescope:eqversion:1.2.1

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:8.0

Trust: 1.0

vendor:avayamodel:integrated managementscope:eqversion:*

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.6

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.6.0

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linuxscope:eqversion:10.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.6

Trust: 1.0

vendor:avayamodel:mn100scope:eqversion:*

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.6

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.3

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.6.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.7

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:13.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.1

Trust: 1.0

vendor:avayamodel:modular messaging message storage serverscope:eqversion:2.0

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linuxscope:eqversion:10.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.5

Trust: 1.0

vendor:sgimodel:propackscope:eqversion:3.0

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:11.0

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.4

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.7.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.7

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.4

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.3

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.7

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.8

Trust: 1.0

vendor:sunmodel:sunosscope:eqversion:5.8

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.8

Trust: 1.0

vendor:gentoomodel:linuxscope:eqversion:*

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3

Trust: 1.0

vendor:sunmodel:sunosscope:eqversion:5.7

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linux corporate serverscope:eqversion:3.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.9

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.9

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.2

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:12.0

Trust: 1.0

vendor:red hatmodel: - scope: - version: -

Trust: 0.8

vendor:sun microsystemsmodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:v10.3.9

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.3.9

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (x86)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linux desktopscope:eqversion:3.0

Trust: 0.8

vendor:red hatmodel:linux advanced workstationscope:eqversion:2.1

Trust: 0.8

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // JVNDB: JVNDB-2004-000574 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-1307
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#356070
value: 22.31

Trust: 0.8

CARNEGIE MELLON: VU#539110
value: 5.04

Trust: 0.8

NVD: CVE-2004-1307
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200412-081
value: HIGH

Trust: 0.6

VULHUB: VHN-9737
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2004-1307
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-9737
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // VULHUB: VHN-9737 // JVNDB: JVNDB-2004-000574 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-1307

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200412-081

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200412-081

CONFIGURATIONS

sources: JVNDB: JVNDB-2004-000574

PATCH

title:Security Update 2005-005url:http://docs.info.apple.com/article.html?artnum=301528

Trust: 0.8

title:Security Update 2005-005url:http://docs.info.apple.com/jarticle.html?artnum=301528

Trust: 0.8

title:RHSA-2004:577url:https://rhn.redhat.com/errata/RHSA-2004-577.html

Trust: 0.8

title:101677url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1

Trust: 0.8

title:RHSA-2004:577url:http://www.jp.redhat.com/support/errata/RHSA/RHSA-2004-577J.html

Trust: 0.8

sources: JVNDB: JVNDB-2004-000574

EXTERNAL IDS

db:CERT/CCid:VU#539110

Trust: 3.3

db:USCERTid:TA05-136A

Trust: 2.5

db:NVDid:CVE-2004-1307

Trust: 2.5

db:SECUNIAid:15227

Trust: 1.7

db:OSVDBid:16084

Trust: 0.8

db:BIDid:13502

Trust: 0.8

db:CERT/CCid:VU#356070

Trust: 0.8

db:SECTRACKid:1012651

Trust: 0.8

db:SECUNIAid:13607

Trust: 0.8

db:JVNDBid:JVNDB-2004-000574

Trust: 0.8

db:CNNVDid:CNNVD-200412-081

Trust: 0.7

db:CERT/CCid:TA05-136A

Trust: 0.6

db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:11175

Trust: 0.6

db:SUNALERTid:101677

Trust: 0.6

db:SUNALERTid:201072

Trust: 0.6

db:APPLEid:APPLE-SA-2005-05-03

Trust: 0.6

db:IDEFENSEid:20041221 LIBTIFF STRIPOFFSETS INTEGER OVERFLOW VULNERABILITY

Trust: 0.6

db:VULHUBid:VHN-9737

Trust: 0.1

db:PACKETSTORMid:37530

Trust: 0.1

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // VULHUB: VHN-9737 // JVNDB: JVNDB-2004-000574 // PACKETSTORM: 37530 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

REFERENCES

url:http://www.us-cert.gov/cas/techalerts/ta05-136a.html

Trust: 2.5

url:http://www.kb.cert.org/vuls/id/539110

Trust: 2.5

url:http://secunia.com/advisories/15227/

Trust: 1.7

url:http://lists.apple.com/archives/security-announce/2005/may/msg00001.html

Trust: 1.7

url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1

Trust: 1.7

url:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1

Trust: 1.7

url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=true

Trust: 1.6

url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11175

Trust: 1.1

url:http://docs.info.apple.com/article.html?artnum=301528

Trust: 0.9

url:http://remahl.se/david/vuln/011/

Trust: 0.9

url:http://secunia.com/advisories/13607/

Trust: 0.9

url:http://www.securityfocus.com/bid/13502/

Trust: 0.8

url:http://www.osvdb.org/displayvuln.php?osvdb_id=16084

Trust: 0.8

url:http://securitytracker.com/alerts/2004/dec/1012651.html

Trust: 0.8

url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-1307

Trust: 0.8

url:http://www.jpcert.or.jp/wr/2005/wr052001.txt

Trust: 0.8

url:http://jvn.jp/cert/jvnta05-136a/

Trust: 0.8

url:http://jvn.jp/tr/trta05-136a/

Trust: 0.8

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-1307

Trust: 0.8

url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:11175

Trust: 0.6

url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=true

Trust: 0.1

url:http://www.apple.com/support/downloads/securityupdate2005005server.html

Trust: 0.1

url:http://www.digitalmunition.com/dma[2005-0502a].txt

Trust: 0.1

url:http://remahl.se/david/vuln/010/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://remahl.se/david/vuln/012/

Trust: 0.1

url:http://remahl.se/david/vuln/004/

Trust: 0.1

url:http://www.apple.com/support/downloads/securityupdate2005005client.html

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

url:http://secunia.com/secunia_vacancies/

Trust: 0.1

url:http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities

Trust: 0.1

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/advisories/14188/

Trust: 0.1

url:http://secunia.com/advisories/12549/

Trust: 0.1

url:http://secunia.com/product/96/

Trust: 0.1

url:http://secunia.com/advisories/13199/

Trust: 0.1

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // VULHUB: VHN-9737 // JVNDB: JVNDB-2004-000574 // PACKETSTORM: 37530 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

CREDITS

Discovery credited to infamous41md[at]hotpop.com.

Trust: 0.6

sources: CNNVD: CNNVD-200412-081

SOURCES

db:CERT/CCid:VU#356070
db:CERT/CCid:VU#539110
db:VULHUBid:VHN-9737
db:JVNDBid:JVNDB-2004-000574
db:PACKETSTORMid:37530
db:CNNVDid:CNNVD-200412-081
db:NVDid:CVE-2004-1307

LAST UPDATE DATE

2024-11-11T20:09:16.909000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#356070date:2005-05-16T00:00:00
db:CERT/CCid:VU#539110date:2005-08-23T00:00:00
db:VULHUBid:VHN-9737date:2018-10-30T00:00:00
db:JVNDBid:JVNDB-2004-000574date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200412-081date:2009-02-05T00:00:00
db:NVDid:CVE-2004-1307date:2018-10-30T16:26:22.763

SOURCES RELEASE DATE

db:CERT/CCid:VU#356070date:2005-05-06T00:00:00
db:CERT/CCid:VU#539110date:2005-01-20T00:00:00
db:VULHUBid:VHN-9737date:2004-12-21T00:00:00
db:JVNDBid:JVNDB-2004-000574date:2007-04-01T00:00:00
db:PACKETSTORMid:37530date:2005-05-29T20:22:44
db:CNNVDid:CNNVD-200412-081date:2004-12-21T00:00:00
db:NVDid:CVE-2004-1307date:2004-12-21T05:00:00