Apple Mac OS X Finder DMG volume name buffer overflow

Overview

Apple Mac OS X Finder fails to properly handle DMG files with large volume names, which could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

DMG files are disk images that can contain a variety of filesystems. Apple Mac OS X Finder contains a buffer overflow vulnerability in the handling of DMG volume names. Specifically, a DMG file with a volume name of more than 255 bytes can trigger memory corruption. Note that by default, Safari will automatically mount DMG files that are referenced in web pages.

---

Impact

By convincing a user to mount a specially-crafted DMG file, such as by viewing a web page with Safari, a remote, unauthenticated attacker may be able to execute code with the privileges of the user or cause a denial-of-service condition.

---

Solution

Apply an update

This issue is addressed in Apple Security Update 2007-002.

---

Disable “Open ‘safe’ files after downloading”

Disable the option “Open ‘safe’ files after downloading,” as specified in the Securing Your Web Browser document. This will help prevent automatic exploitation of this and other vulnerabilities.

---

Vendor Information

240880

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Apple Computer, Inc. __ Affected

Updated: February 16, 2007

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Apple Security Update 2007-002.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23240880 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://projects.info-pull.com/moab/MOAB-09-01-2007.html&gt;
• <http://docs.info.apple.com/article.html?artnum=305102&gt;
• <http://secunia.com/advisories/24198/&gt;
• <http://securitytracker.com/alerts/2007/Feb/1017662.html&gt;
• <http://www.securityfocus.com/bid/21980&gt;

Acknowledgements

This vulnerability was publicly disclosed by LMH.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2007-0197
Severity Metric:	10.29 Date Public: