Critical Apple flaw discovered in Mac OS X
Attackers can exploit the flaw remotely to compromise a user's system via the Safari Web browser.
Danish vulnerability clearinghouse Secunia rated the flaw highly critical because it can be remotely exploited by an attacker in the Safari Web browser when the "opening safe files after downloading" option is enabled, Secunia said in its advisory.
The flaw, discovered by security researcher who goes by the name "LMH," is an integer overflow error in the ffs_mountfs() function. When the ffs mountfs() function handles UFS filesystem disc images the operating system can be exploited to cause a buffer overflow by using a UFS DMG image, LMH said in his Month of Apple Bugs Web site.
The flaw can lead to an exploitable denial of service condition and potential arbitrary code execution, LMH said.
"Arbitrary code execution is possible, as we control the size parameter used for buffer allocation and data is being copied directly from the stream in the DMG image," LMH said in his advisory.
Mac OS X 10.4.8 is affected as well as FreeBSD 6.1. Earlier versions may also be affected, LMH said.
The recommended workaround until Apple releases a fix is to not attempt to mount untrusted DMG files, and disable Safari 'Open safe files' in it's preferences dialog.
The flaw is related to a DMG image handling issue announced in November by the Month of Kernel Bugs, LMH said.
The Month of Apple Bugs project was launched Jan. 1 and is an offshoot of the Month of Kernel Bugs project, both run by researcher LMH. The Month of Kernel Bugs was inspired by the Month of Browser Bugs, spearheaded by Metasploit Framework creator H.D. Moore last July.
The Month of Apple Bugs site was launched detailing a highly critical flaw in Apple's widely used QuickTime media player.
