CVE-2008-1035

Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource liberation" bug. NOTE:...

Apple Mac OS X 2008-003更新修复多个安全漏洞

BUGTRAQ ID: 29412 CVECAN ID: CVE-2008-1027,CVE-2008-1028,CVE-2008-1577,CVE-2008-1575,CVE-2008-1580,CVE-2008-1030,CVE-2008-1031,CVE-2008-1032,CVE-2008-1033,CVE-2008-1034,CVE-2008-1035,CVE-2008-1036,CVE-2008-1571,CVE-2008-1572,CVE-2008-1573,CVE-2008-1574,CVE-2008-1576,CVE-2008-1578,CVE-2008-1579 Ma...

Apple iCal COUNT参数整数溢出漏洞

BUGTRAQ ID: 28629 CVECAN ID: CVE-2008-2006 iCal是Mac OS X操作系统中所捆绑的个人日历程序。 iCal在处理畸形格式的ICS文件时存在漏洞，可能导致应用程序处理时崩溃。 iCal没有正确的过滤整数输入，如果用户受骗打开的.ics文件包含有以下行的话： /----------- RRULE:FREQ=DAILY;INTERVAL=1;COUNT=2147483646 - -----------/ COUNT值就会触发整数溢出，导致iCal在导入.ics文件后试图使用该值时出现空指针引用，应用程序会崩溃。 Apple iCal 3.0.1...

Apple iCal TRIGGER参数拒绝服务漏洞

BUGTRAQ ID: 28632 CVECAN ID: CVE-2008-2006 iCal是Mac OS X操作系统中所捆绑的个人日历程序。 iCal在处理畸形格式的ICS文件时存在漏洞，可能导致应用程序处理时崩溃。 如果用户受骗打开的.ics文件包含有以下行的话： /----------- TRIGGER:-PT65535H - -----------/ iCal在导入.ics文件后试图使用TRIGGER值时会出现空指针引用，导致应用程序崩溃。 Apple iCal 3.0.1 Apple -----...

Apple iCal ATTACH参数拒绝服务漏洞

BUGTRAQ ID: 28633 CVECAN ID: CVE-2008-2007 iCal是Mac OS X操作系统中所捆绑的个人日历程序。 iCal在处理畸形格式的ICS文件时存在漏洞，可能导致应用程序处理时崩溃。 如果用户受骗打开的.ics文件包含有以下行的话： /----------- ATTACH;VALUE=URI:S=osumi - -----------/ iCal在导入.ics文件后试图使用ATTACH值时会出现错误的资源释放，导致应用程序崩溃。 Apple iCal 3.0.1 Apple -----...

CVE-2008-2006

Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service NULL pointer dereference and application crash or possibly execute arbitrary code via a .ics file containing 1 a large 16-bit integer on a TRIGGER line, or 2 a large integer...

CVE-2008-2006

Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service NULL pointer dereference and application crash or possibly execute arbitrary code via a .ics file containing 1 a large 16-bit integer on a TRIGGER line, or 2 a large integer...

CVE-2008-2006

Summary of the CVE-2008-2006 family (Apple iCal) : The iCal client on Mac OS X 10.5.x (notably 3.0.1; affected up to 10.5.2; PoCs mention 3.0.1/3.0.2) contains multiple input-validation bugs in ICS parsing. Root causes include (1) integer overflow/null-pointer dereference on a COUNT value in an R...

Apple iCAL multiple security vulnerabilities

Multiple vulnerabilities on .ics files parsing...

Core Security Technologies Advisory 2008.0126

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Multiple vulnerabilities in iCal Advisory Information Title: Multiple vulnerabilities in iCal Advisory ID: CORE-2008-0126 Advisory URL:...

Multiple vulnerabilities in iCal

Advisory ID Internal CORE-2008-0126 Advisory Information Title: Multiple vulnerabilities in iCal Advisory ID: CORE-2008-0126 Advisory URL:https://www.coresecurity.com/core-labs/advisories/ical Date published: 2008-05-21 Date of last update: 2008-05-22 Vendors contacted: Apple Inc. Release mode:...

Apple iCal 3.0.1 - COUNT Integer Overflow

Apple iCal 3.0.1 - COUNT Integer Overflow source: https://www.securityfocus.com/bid/28629/info Apple iCal is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. An attacker can exploit this issue to execute arbitrary code within the context of...

Apple iCal 3.0.1 - TRIGGER Denial of Service

Apple iCal 3.0.1 - TRIGGER Denial of Service source: https://www.securityfocus.com/bid/28632/info Apple iCal is prone to a denial-of-service vulnerability because it fails to handle specially crafted files. An attacker can exploit this issue to crash the affected application, denying service to...

Apple iCal 3.0.1 - ATTACH Denial of Service

Apple iCal 3.0.1 - ATTACH Denial of Service source: https://www.securityfocus.com/bid/28633/info Apple iCal is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input data. Successful exploits will crash the application. Given the nature of this issu...

Apple iCal 3.0.1 - 'ATTACH' Denial of Service

source: https://www.securityfocus.com/bid/28633/info Apple iCal is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input data. Successful exploits will crash the application. Given the nature of this issue, attackers may also be able to run arbitra...

Apple iCal 3.0.1 - 'COUNT' Integer Overflow

source: https://www.securityfocus.com/bid/28629/info Apple iCal is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit...

Apple iCal 3.0.1 - 'TRIGGER' Denial of Service

source: https://www.securityfocus.com/bid/28632/info Apple iCal is prone to a denial-of-service vulnerability because it fails to handle specially crafted files. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. This issue affects iCal 3.0....

wolioCMS Auth Bypass / Remote SQL Injection Vulnerabilities

No description provided by source. wolioCMS - SQL Injection and Bypass Administrator Login Vendor : http://www.buton.web.id/member.php?member=anon Download : http://www.buton.web.id/download/woliocms.zip Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net...

Microsoft Exchange Server iCal Properties Denial of Service (MS07-026; CVE-2007-0039)

Simple Mail Transfer Protocol SMTP is a core Internet protocol used for transferring e-mail across the Internet. The Microsoft Exchange Server is a collaborative software server from Microsoft capable of handling numerous Internet protocols, including the Simple Mail Transfer Protocol SMTP. It is...

Microsoft Exchange iCal请求远程拒绝服务漏洞（MS07-026）

Microsoft Exchange Server是一款流行的邮件服务器。 Microsoft Exchange中负责解析iCal邮件附件的代码中漏洞，远程攻击者可能利用此漏洞导致Exchange进程崩溃。 iCal文件格式包含有一系列的记录，由BEGIN和END标签划分开，每个记录都可能包含有多个命名属性。Exchange的iCal解析器维护一个当前环境中有效属性的表格，遇到新的记录就会切换到合适的表格。X-MICROSOFT-CDO-MODPROPS属性是一个Microsoft扩展，允许iCal文件指定特定记录中应认为有效的属性列表，这时Exchange会乎略所有其他属性，如下所示：...