var-200905-0053
Vulnerability from variot
Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service (application crash) via long HTTP headers. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-002. The security update addresses new vulnerabilities that affect Apple Type Services, CFNetwork, CoreGraphics, Disk Images, Help Viewer, iChat, ICU, Kernel, Launch Services, QuickDraw Manager, and Spotlight components of Mac OS X. The advisory also contains security updates for 47 previously reported issues. An attacker can exploit this issue by tricking a victim into visiting a specially crafted website. A successful attack will allow attacker-supplied code to run in the context of the user running the affected application.
I.
II. Impact
The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation.
III.
IV. References
-
Apple Security Update 2009-002 - http://support.apple.com/kb/HT3549
-
Safari 3.2.3 - http://support.apple.com/kb/HT3550
-
Apple Downloads - http://support.apple.com/downloads/
-
Software Update - https://support.apple.com/kb/HT1338?viewlocale=en_US
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA09-133A.html>
Feedback can be directed to US-CERT Technical Staff. Please send email to cert@cert.org with "TA09-133A Feedback VU#175188" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2009 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
Revision History
May 13, 2009: Initial release
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBSgsdiHIHljM+H4irAQIsGAf+IykbS/FD1X/R2ooezndAmZjrcT29XnpV HO4DiMlKmqW+dUffk4mdJLVR7y8pwUuP4TbjwncoT39SDR9UoEankv7+Dao/qkM/ Jp0flkEpb5qtcIm9VnuWvpCE31OZZgwBwJ7f2WWzbBLqoZ5FIWAhCcW6E5v6mjVy J+Z4BmHYUIapPLzGzV8+HT6/7LRNpg+mZoldEBUoXXjik8o78v5A7iGyMSXoaBlV vL8N/3GG9a9xecLqbbv5N6ABsncHA9f/GzBnfJUqVHkUM1xnjqmgd7TZikObw+fJ xcgWvmYmoRdCMzM3b1jPqWPDGJDbo0oHZM3J3hKE+opsLe9xChM1qA== =dQ2L -----END PGP SIGNATURE----- . ----------------------------------------------------------------------
Are you missing:
SECUNIA ADVISORY ID:
Critical:
Impact:
Where:
within the advisory below?
This is now part of the Secunia commercial solutions.
1) A vulnerability in Apache when handling FTP proxy requests can be exploited by malicious people to conduct cross-site scripting attacks.
For more information: SA31384
2) A boundary error in the handling of Compact Font Format (CFF) fonts in Apple Type Services can be exploited to cause a heap-based buffer overflow when specially crafted document is downloaded or viewed.
Successful exploitation allows execution of arbitrary code.
3) A vulnerability in BIND can potentially be exploited by malicious people to conduct spoofing attacks.
For more information: SA33404
4) An error in the parsing of Set-Cookie headers in CFNetwork can result in applications using CFNetwork sending sensitive information in unencrypted HTTP requests.
Successful exploitation allows execution of arbitrary code.
6) Multiple errors exist in the processing of PDF files in CoreGraphics, which can be exploited to corrupt memory and execute arbitrary code via a specially crafted PDF file.
7) An integer underflow error in the processing of PDF files in CoreGraphics can be exploited to cause a heap-based buffer overflow when specially crafted PDF files is opened.
Successful exploitation allows execution of arbitrary code.
8) Multiple vulnerabilities in the processing of JBIG2 streams within PDF files in CoreGraphics can be exploited by malicious people to compromise a user's system.
For more information: SA34291
9) Multiple vulnerabilities in cscope can be exploited by malicious people to compromise a user's system.
For more information: SA34978:
10) A boundary error in the handling of disk images can be exploited to cause a stack-based buffer overflow when a specially crafted disk image is mounted.
11) Multiple unspecified errors in the handling of disk images can be exploited to cause memory corruptions when a specially crafted disk image is mounted.
Successful exploitation of vulnerabilities #10 and #11 allows execution of arbitrary code.
12) Multiple vulnerabilities in enscript can be exploited by malicious people to compromise a vulnerable system.
For more information: SA13968 SA32137
13) Multiple vulnerabilities in the Flash Player plugin can be exploited by malicious people to compromise a user's system.
For more information: SA34012
14) An error in Help Viewer when loading Cascading Style Sheets referenced in URL parameters can be exploited to invoke arbitrary AppleScript files.
15) A vulnerability exists due to Help Viewer not validating that full paths to HTML documents are within registered help books, which can be exploited to invoke arbitrary AppleScript files.
Successful exploitation of vulnerabilities #14 and #15 allows execution of arbitrary code.
16) An error in iChat can result in AIM communication configured for SSL to be sent in plaintext.
17) An error in the handling of certain character encodings in ICU can be exploited to bypass filters on websites that attempt to mitigate cross-site scripting.
18) Some vulnerabilities in IPSec can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).
For more information: SA31450 SA31478
19) Multiple vulnerabilities in Kerberos can be exploited by malicious people to potentially disclose sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system.
For more information: SA34347
20) An error in the handling of workqueues within the kernel can be exploited by malicious, local users to cause a DoS or execute arbitrary code with Kernel privileges.
21) An error in Launch Services can cause Finder to repeatedly terminate and relaunch when a specially crafted Mach-O is downloaded.
22) A vulnerability in libxml can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.
For more information: SA31558
23) A vulnerability in Net-SNMP can be exploited by malicious people to cause a DoS (Denial of Service).
For more information: SA32560
24) A vulnerability in Network Time can be exploited by malicious people to conduct spoofing attacks.
For more information: SA33406
25) A vulnerability in Network Time can be exploited by malicious people to potentially compromise a user's system.
For more information: SA34608
26) A vulnerability in Networking can be exploited by malicious people to cause a DoS (Denial of Service).
For more information: SA31745
27) A vulnerability in OpenSSL can be exploited by malicious people to conduct spoofing attacks.
For more information: SA33338
28) Some vulnerabilities in PHP can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system, and by malicious, local users to bypass certain security restrictions.
For more information: SA32964
29) An unspecified error in QuickDraw Manager can be exploited to cause a memory corruption and potentially execute arbitrary code via a specially crafted PICT image.
30) An integer underflow error in the handling of PICT images in QuickDraw Manager can be exploited to cause a heap-based buffer overflow via a specially crafted PICT file.
Successful exploitation allows execution of arbitrary code.
31) Multiple vulnerabilities in ruby can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and conduct spoofing attacks.
For more information: SA31430 SA31602
32) An error in the use of the OpenSSL library in ruby can cause revoked certificates to be accepted.
33) A vulnerability in Safari when handling "feed:" URLs can be exploited to compromise a user's system.
For more information: SA35056
34) Multiple unspecified errors in Spotlight can be exploited to cause memory corruptions and execute arbitrary code when a specially crafted Office document is downloaded.
35) An error when invoking the "login" command can result in unexpected high privileges.
36) A boundary error in telnet can be exploited to cause a stack-based buffer overflow when connecting to a server with an overly long canonical name in its DNS address record.
37) A vulnerability in WebKit when handling SVGList objects can be exploited to corrupt memory and potentially execute arbitrary code.
For more information: SA35056
38) Multiple vulnerabilities in FreeType can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise applications using the library.
For more information: SA20100 SA25350 SA34723
39) A vulnerability in xterm can be exploited by malicious people to compromise a user's system.
For more information: SA33318
40) Multiple vulnerabilities in libpng can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library. Nathan 8) Alin Rad Pop, Secunia Research and Will Dormann, CERT/CC 10) Tiller Beauchamp, IOActive 14, 15) Brian Mastenbrook 17) Chris Weber of Casaba Security 20) An anonymous researcher working with Verisign iDefense VCP 30) Damian Put and Sebastian Apelt, working with ZDI, and Chris Ries of Carnegie Mellon University Computing Services 38) Tavis Ormandy of the Google Security Team
OTHER REFERENCES: SA13968: http://secunia.com/advisories/13968/
SA20100: http://secunia.com/advisories/20100/
SA25350: http://secunia.com/advisories/25350/
SA29792: http://secunia.com/advisories/29792/
SA31384: http://secunia.com/advisories/31384/
SA31430: http://secunia.com/advisories/31430/
SA31450: http://secunia.com/advisories/31450/
SA31478: http://secunia.com/advisories/31478/
SA31558: http://secunia.com/advisories/31558/
SA31602: http://secunia.com/advisories/31602/
SA31745: http://secunia.com/advisories/31745/
SA32137: http://secunia.com/advisories/32137/
SA32560: http://secunia.com/advisories/32560/
SA32964: http://secunia.com/advisories/32964/
SA33318: http://secunia.com/advisories/33318/
SA33338: http://secunia.com/advisories/33338/
SA33404: http://secunia.com/advisories/33404/
SA33406: http://secunia.com/advisories/33406/
SA33970: http://secunia.com/advisories/33970/
SA34012: http://secunia.com/advisories/34012/
SA34291: http://secunia.com/advisories/34291/
SA34347: http://secunia.com/advisories/34347/
SA34608: http://secunia.com/advisories/34608/
SA34723: http://secunia.com/advisories/34723/
SA34978: http://secunia.com/advisories/34978/
SA35056: http://secunia.com/advisories/35056/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. n.runs AG http://www.nruns.com/ security(at)nruns.com n.runs-SA-2009.001 15-May-2009
Vendor: Apple Inc., http://www.apple.com Affected Products: Mac OS X 10.5.6 Vulnerability: Heap-based buffer overflow in CFNetwork component (remote) Risk: HIGH
Vendor communication:
2009/04/17 Initial notification of Apple including n.runs RFP 2009/04/27 Received response from Apple about planned disclosure date 2009/04/29 Received update from Apple about adjusted disclosure date 2009/05/12 Apple issues updates
Overview:
CFNetwork is a framework in the Core Services framework that provides a library of abstractions for network protocols. It can be used to perform a variety of network tasks using different protocols such as SSL/TLS, DNS, FTP and HTTP. Besides many other applications the CFNetwork framework is used by Safari and Mail.
Description:
A remotely exploitable vulnerability has been found in the HTTP header parsing code. Each HTTP header received from a web server is first capitalized. I.e. the first character of the header name is upper-cased while all remaining characters are lower-cased. Inside the CFNetwork framework the _CFCapitalizeHeader() function is used for this purpose.
The first thing this function does is to convert the header name into UTF-16 encoded form. Depending on the length of the header name the result is either stored in a local stack buffer or in a buffer allocated on the heap. For all header names > 511 bytes a heap buffer is allocated as follows:
__text:00003A35 loc_3A35: __text:00003A35 mov esi, [ebp+var_810] __text:00003A3B add esi, esi __text:00003A3D mov [esp+838h+var_838], esi __text:00003A40 call _malloc
At address 0x00003A35 the length of the header name is stored in %esi and then doubled to hold the UTF-16 encoded variant. After the buffer was allocated some variables are setup. At 0x00003A4D the destination pointer for the following memory copy operation is stored.
__text:00003A45 add esi, eax __text:00003A47 mov [ebp+var_81C], eax __text:00003A4D mov [ebp+var_814], esi __text:00003A53 mov [ebp+var_818], eax
Note that in contrary to the stack buffer, where a pointer to the start of the buffer is stored in [ebp+var_814], this code stores a pointer to the end of the allocated buffer. The following memory copy loop starting at 0x00003AD1 then stores the UTF-16 encoded header name not inside the buffer, but directly after it which leads to an exploitable heap-based buffer overflow.
Impact:
One attack vector is the Safari browser. An attacker can exploit this vulnerability by providing his own web server.
Solution:
Apple has issued an update to correct this vulnerability. More details can be found at: http://support.apple.com/kb/HT1222
Credit: Bug found by Moritz Jodeit of n.runs AG.
References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0157
This Advisory and Upcoming Advisories: http://www.nruns.com/security_advisory.php
Unaltered electronic reproduction of this advisory is permitted. For all other reproduction or publication, in printing or otherwise, contact security@nruns.com for permission. Use of the advisory constitutes acceptance for use in an "as is" condition. All warranties are excluded. In no event shall n.runs be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if n.runs has been advised of the possibility of such damages.
Copyright 2009 n.runs AG. All rights reserved. Terms of use apply.
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200905-0053",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.4"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.2"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.0"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.2"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.1"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.4"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.5"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.0"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.5.3"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.5.3"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.5.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.5.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.5.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5 to v10.5.6"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5 to v10.5.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.11"
}
],
"sources": [
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Charlie MillerAndrew MortensenMoritz Jodeit moritz@jodeit.org",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
}
],
"trust": 0.6
},
"cve": "CVE-2009-0157",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2009-0157",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-37603",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2009-0157",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2009-0157",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200905-173",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-37603",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service (application crash) via long HTTP headers. Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-002. \nThe security update addresses new vulnerabilities that affect Apple Type Services, CFNetwork, CoreGraphics, Disk Images, Help Viewer, iChat, ICU, Kernel, Launch Services, QuickDraw Manager, and Spotlight components of Mac OS X. The advisory also contains security updates for 47 previously reported issues. \nAn attacker can exploit this issue by tricking a victim into visiting a specially crafted website. \nA successful attack will allow attacker-supplied code to run in the context of the user running the affected application. \n\n\nI. \n\n\nII. Impact\n\n The impacts of these vulnerabilities vary. Potential consequences\n include arbitrary code execution, sensitive information disclosure,\n denial of service, or privilege escalation. \n\n\nIII. \n\n\nIV. References\n\n * Apple Security Update 2009-002 -\n \u003chttp://support.apple.com/kb/HT3549\u003e\n\n * Safari 3.2.3 - \u003chttp://support.apple.com/kb/HT3550\u003e \n\n * Apple Downloads - \u003chttp://support.apple.com/downloads/\u003e\n\n * Software Update -\n \u003chttps://support.apple.com/kb/HT1338?viewlocale=en_US\u003e\n\n ____________________________________________________________________\n\n The most recent version of this document can be found at:\n\n \u003chttp://www.us-cert.gov/cas/techalerts/TA09-133A.html\u003e\n ____________________________________________________________________\n\n Feedback can be directed to US-CERT Technical Staff. Please send\n email to \u003ccert@cert.org\u003e with \"TA09-133A Feedback VU#175188\" in\n the subject. \n ____________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n Produced 2009 by US-CERT, a government organization. \n\n Terms of use:\n\n \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\nRevision History\n \n May 13, 2009: Initial release\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.5 (GNU/Linux)\n\niQEVAwUBSgsdiHIHljM+H4irAQIsGAf+IykbS/FD1X/R2ooezndAmZjrcT29XnpV\nHO4DiMlKmqW+dUffk4mdJLVR7y8pwUuP4TbjwncoT39SDR9UoEankv7+Dao/qkM/\nJp0flkEpb5qtcIm9VnuWvpCE31OZZgwBwJ7f2WWzbBLqoZ5FIWAhCcW6E5v6mjVy\nJ+Z4BmHYUIapPLzGzV8+HT6/7LRNpg+mZoldEBUoXXjik8o78v5A7iGyMSXoaBlV\nvL8N/3GG9a9xecLqbbv5N6ABsncHA9f/GzBnfJUqVHkUM1xnjqmgd7TZikObw+fJ\nxcgWvmYmoRdCMzM3b1jPqWPDGJDbo0oHZM3J3hKE+opsLe9xChM1qA==\n=dQ2L\n-----END PGP SIGNATURE-----\n. ----------------------------------------------------------------------\n\nAre you missing:\n\nSECUNIA ADVISORY ID:\n\nCritical:\n\nImpact:\n\nWhere:\n\nwithin the advisory below?\n\nThis is now part of the Secunia commercial solutions. \n\n1) A vulnerability in Apache when handling FTP proxy requests can be\nexploited by malicious people to conduct cross-site scripting\nattacks. \n\nFor more information:\nSA31384\n\n2) A boundary error in the handling of Compact Font Format (CFF)\nfonts in Apple Type Services can be exploited to cause a heap-based\nbuffer overflow when specially crafted document is downloaded or\nviewed. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n3) A vulnerability in BIND can potentially be exploited by malicious\npeople to conduct spoofing attacks. \n\nFor more information:\nSA33404\n\n4) An error in the parsing of Set-Cookie headers in CFNetwork can\nresult in applications using CFNetwork sending sensitive information\nin unencrypted HTTP requests. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n6) Multiple errors exist in the processing of PDF files in\nCoreGraphics, which can be exploited to corrupt memory and execute\narbitrary code via a specially crafted PDF file. \n\n7) An integer underflow error in the processing of PDF files in\nCoreGraphics can be exploited to cause a heap-based buffer overflow\nwhen specially crafted PDF files is opened. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n8) Multiple vulnerabilities in the processing of JBIG2 streams within\nPDF files in CoreGraphics can be exploited by malicious people to\ncompromise a user\u0027s system. \n\nFor more information:\nSA34291\n\n9) Multiple vulnerabilities in cscope can be exploited by malicious\npeople to compromise a user\u0027s system. \n\nFor more information:\nSA34978:\n\n10) A boundary error in the handling of disk images can be exploited\nto cause a stack-based buffer overflow when a specially crafted disk\nimage is mounted. \n\n11) Multiple unspecified errors in the handling of disk images can be\nexploited to cause memory corruptions when a specially crafted disk\nimage is mounted. \n\nSuccessful exploitation of vulnerabilities #10 and #11 allows\nexecution of arbitrary code. \n\n12) Multiple vulnerabilities in enscript can be exploited by\nmalicious people to compromise a vulnerable system. \n\nFor more information:\nSA13968\nSA32137\n\n13) Multiple vulnerabilities in the Flash Player plugin can be\nexploited by malicious people to compromise a user\u0027s system. \n\nFor more information:\nSA34012\n\n14) An error in Help Viewer when loading Cascading Style Sheets\nreferenced in URL parameters can be exploited to invoke arbitrary\nAppleScript files. \n\n15) A vulnerability exists due to Help Viewer not validating that\nfull paths to HTML documents are within registered help books, which\ncan be exploited to invoke arbitrary AppleScript files. \n\nSuccessful exploitation of vulnerabilities #14 and #15 allows\nexecution of arbitrary code. \n\n16) An error in iChat can result in AIM communication configured for\nSSL to be sent in plaintext. \n\n17) An error in the handling of certain character encodings in ICU\ncan be exploited to bypass filters on websites that attempt to\nmitigate cross-site scripting. \n\n18) Some vulnerabilities in IPSec can be exploited by malicious users\nand malicious people to cause a DoS (Denial of Service). \n\nFor more information:\nSA31450\nSA31478\n\n19) Multiple vulnerabilities in Kerberos can be exploited by\nmalicious people to potentially disclose sensitive information, cause\na DoS (Denial of Service), or potentially compromise a vulnerable\nsystem. \n\nFor more information:\nSA34347\n\n20) An error in the handling of workqueues within the kernel can be\nexploited by malicious, local users to cause a DoS or execute\narbitrary code with Kernel privileges. \n\n21) An error in Launch Services can cause Finder to repeatedly\nterminate and relaunch when a specially crafted Mach-O is\ndownloaded. \n\n22) A vulnerability in libxml can be exploited by malicious people to\ncause a DoS (Denial of Service) or potentially compromise an\napplication using the library. \n\nFor more information:\nSA31558\n\n23) A vulnerability in Net-SNMP can be exploited by malicious people\nto cause a DoS (Denial of Service). \n\nFor more information:\nSA32560\n\n24) A vulnerability in Network Time can be exploited by malicious\npeople to conduct spoofing attacks. \n\nFor more information:\nSA33406\n\n25) A vulnerability in Network Time can be exploited by malicious\npeople to potentially compromise a user\u0027s system. \n\nFor more information:\nSA34608\n\n26) A vulnerability in Networking can be exploited by malicious\npeople to cause a DoS (Denial of Service). \n\nFor more information:\nSA31745\n\n27) A vulnerability in OpenSSL can be exploited by malicious people\nto conduct spoofing attacks. \n\nFor more information:\nSA33338\n\n28) Some vulnerabilities in PHP can be exploited by malicious people\nto cause a DoS (Denial of Service) or potentially compromise a\nvulnerable system, and by malicious, local users to bypass certain\nsecurity restrictions. \n\nFor more information:\nSA32964\n\n29) An unspecified error in QuickDraw Manager can be exploited to\ncause a memory corruption and potentially execute arbitrary code via\na specially crafted PICT image. \n\n30) An integer underflow error in the handling of PICT images in\nQuickDraw Manager can be exploited to cause a heap-based buffer\noverflow via a specially crafted PICT file. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n31) Multiple vulnerabilities in ruby can be exploited by malicious\npeople to bypass certain security restrictions, cause a DoS (Denial\nof Service), and conduct spoofing attacks. \n\nFor more information:\nSA31430\nSA31602\n\n32) An error in the use of the OpenSSL library in ruby can cause\nrevoked certificates to be accepted. \n\n33) A vulnerability in Safari when handling \"feed:\" URLs can be\nexploited to compromise a user\u0027s system. \n\nFor more information:\nSA35056\n\n34) Multiple unspecified errors in Spotlight can be exploited to\ncause memory corruptions and execute arbitrary code when a specially\ncrafted Office document is downloaded. \n\n35) An error when invoking the \"login\" command can result in\nunexpected high privileges. \n\n36) A boundary error in telnet can be exploited to cause a\nstack-based buffer overflow when connecting to a server with an\noverly long canonical name in its DNS address record. \n\n37) A vulnerability in WebKit when handling SVGList objects can be\nexploited to corrupt memory and potentially execute arbitrary code. \n\nFor more information:\nSA35056\n\n38) Multiple vulnerabilities in FreeType can be exploited by\nmalicious people to cause a DoS (Denial of Service) and potentially\ncompromise applications using the library. \n\nFor more information:\nSA20100\nSA25350\nSA34723\n\n39) A vulnerability in xterm can be exploited by malicious people to\ncompromise a user\u0027s system. \n\nFor more information:\nSA33318\n\n40) Multiple vulnerabilities in libpng can be exploited by malicious\npeople to cause a DoS (Denial of Service) or to potentially\ncompromise an application using the library. Nathan\n8) Alin Rad Pop, Secunia Research and Will Dormann, CERT/CC\n10) Tiller Beauchamp, IOActive\n14, 15) Brian Mastenbrook\n17) Chris Weber of Casaba Security\n20) An anonymous researcher working with Verisign iDefense VCP\n30) Damian Put and Sebastian Apelt, working with ZDI, and Chris Ries\nof Carnegie Mellon University Computing Services\n38) Tavis Ormandy of the Google Security Team\n\nOTHER REFERENCES:\nSA13968:\nhttp://secunia.com/advisories/13968/\n\nSA20100:\nhttp://secunia.com/advisories/20100/\n\nSA25350:\nhttp://secunia.com/advisories/25350/\n\nSA29792:\nhttp://secunia.com/advisories/29792/\n\nSA31384:\nhttp://secunia.com/advisories/31384/\n\nSA31430:\nhttp://secunia.com/advisories/31430/\n\nSA31450:\nhttp://secunia.com/advisories/31450/\n\nSA31478:\nhttp://secunia.com/advisories/31478/\n\nSA31558:\nhttp://secunia.com/advisories/31558/\n\nSA31602:\nhttp://secunia.com/advisories/31602/\n\nSA31745:\nhttp://secunia.com/advisories/31745/\n\nSA32137:\nhttp://secunia.com/advisories/32137/\n\nSA32560:\nhttp://secunia.com/advisories/32560/\n\nSA32964:\nhttp://secunia.com/advisories/32964/\n\nSA33318:\nhttp://secunia.com/advisories/33318/\n\nSA33338:\nhttp://secunia.com/advisories/33338/\n\nSA33404:\nhttp://secunia.com/advisories/33404/\n\nSA33406:\nhttp://secunia.com/advisories/33406/\n\nSA33970:\nhttp://secunia.com/advisories/33970/\n\nSA34012:\nhttp://secunia.com/advisories/34012/\n\nSA34291:\nhttp://secunia.com/advisories/34291/\n\nSA34347:\nhttp://secunia.com/advisories/34347/\n\nSA34608:\nhttp://secunia.com/advisories/34608/\n\nSA34723:\nhttp://secunia.com/advisories/34723/\n\nSA34978:\nhttp://secunia.com/advisories/34978/\n\nSA35056:\nhttp://secunia.com/advisories/35056/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. n.runs AG\nhttp://www.nruns.com/ security(at)nruns.com\nn.runs-SA-2009.001 15-May-2009\n________________________________________________________________________\n\nVendor: \t\t\tApple Inc., http://www.apple.com\nAffected Products: \tMac OS X 10.5.6\nVulnerability: \t\tHeap-based buffer overflow in CFNetwork component\n(remote)\nRisk: \t\t\tHIGH\n________________________________________________________________________\n\nVendor communication:\n\n2009/04/17 Initial notification of Apple including n.runs RFP\n2009/04/27 Received response from Apple about planned disclosure date\n2009/04/29 Received update from Apple about adjusted disclosure date\n2009/05/12 Apple issues updates\n________________________________________________________________________\n\nOverview:\n\nCFNetwork is a framework in the Core Services framework that provides a\nlibrary of abstractions for network protocols. It can be used to perform\na variety of network tasks using different protocols such as SSL/TLS,\nDNS, FTP and HTTP. \nBesides many other applications the CFNetwork framework is used by\nSafari and Mail. \n\nDescription:\n\nA remotely exploitable vulnerability has been found in the HTTP header\nparsing code. Each HTTP header received from a web server is first\ncapitalized. I.e. the first character of the header name is upper-cased\nwhile all remaining characters are lower-cased. Inside the CFNetwork\nframework the _CFCapitalizeHeader() function is used for this purpose. \n\nThe first thing this function does is to convert the header name into\nUTF-16 encoded form. Depending on the length of the header name the\nresult is either stored in a local stack buffer or in a buffer\nallocated on the heap. For all header names \u003e 511 bytes a heap buffer\nis allocated as follows:\n\n__text:00003A35 loc_3A35:\n__text:00003A35 mov esi, [ebp+var_810]\n__text:00003A3B add esi, esi\n__text:00003A3D mov [esp+838h+var_838], esi\n__text:00003A40 call _malloc\n\nAt address 0x00003A35 the length of the header name is stored in %esi\nand then doubled to hold the UTF-16 encoded variant. After the buffer\nwas allocated some variables are setup. At 0x00003A4D the destination\npointer for the following memory copy operation is stored. \n\n__text:00003A45 add esi, eax\n__text:00003A47 mov [ebp+var_81C], eax\n__text:00003A4D mov [ebp+var_814], esi\n__text:00003A53 mov [ebp+var_818], eax\n\nNote that in contrary to the stack buffer, where a pointer to the\n_start_ of the buffer is stored in [ebp+var_814], this code stores\na pointer to the _end_ of the allocated buffer. The following\nmemory copy loop starting at 0x00003AD1 then stores the UTF-16\nencoded header name not inside the buffer, but directly after it\nwhich leads to an exploitable heap-based buffer overflow. \n\nImpact:\n\nOne attack vector is the Safari browser. An attacker can exploit\nthis vulnerability by providing his own web server. \n\nSolution:\n\nApple has issued an update to correct this vulnerability. More details\ncan be found at: http://support.apple.com/kb/HT1222\n________________________________________________________________________\n\nCredit:\nBug found by Moritz Jodeit of n.runs AG. \n________________________________________________________________________\n\nReferences:\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0157\n\nThis Advisory and Upcoming Advisories:\nhttp://www.nruns.com/security_advisory.php\n________________________________________________________________________\n\nUnaltered electronic reproduction of this advisory is permitted. For all\nother reproduction or publication, in printing or otherwise, contact\nsecurity@nruns.com for permission. Use of the advisory constitutes\nacceptance for use in an \"as is\" condition. All warranties are excluded. In\nno event shall n.runs be liable for any damages whatsoever including direct,\nindirect, incidental, consequential, loss of business profits or special\ndamages, even if n.runs has been advised of the possibility of such damages. \n\n\nCopyright 2009 n.runs AG. All rights reserved. Terms of use apply. \n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0157"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
},
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "PACKETSTORM",
"id": "77494"
},
{
"db": "PACKETSTORM",
"id": "77488"
},
{
"db": "PACKETSTORM",
"id": "77529"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-37603",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-0157",
"trust": 2.9
},
{
"db": "USCERT",
"id": "TA09-133A",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "35074",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2009-1297",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1022211",
"trust": 2.5
},
{
"db": "BID",
"id": "34926",
"trust": 2.0
},
{
"db": "XF",
"id": "50480",
"trust": 1.4
},
{
"db": "USCERT",
"id": "SA09-133A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315",
"trust": 0.8
},
{
"db": "APPLE",
"id": "APPLE-SA-2009-05-12",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA09-133A",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173",
"trust": 0.6
},
{
"db": "BID",
"id": "34958",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "77529",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-37603",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77494",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77488",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "PACKETSTORM",
"id": "77494"
},
{
"db": "PACKETSTORM",
"id": "77488"
},
{
"db": "PACKETSTORM",
"id": "77529"
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"id": "VAR-200905-0053",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T19:38:23.093000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT3549",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3549"
},
{
"title": "HT3549",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3549?viewlocale=ja_JP"
},
{
"title": "TA09-133A",
"trust": 0.8,
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta09-133a.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta09-133a.html"
},
{
"trust": 2.5,
"url": "http://www.securitytracker.com/id?1022211"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/35074"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2009/1297"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2009/may/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/34926"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht3549"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/50480"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50480"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0157"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta09-133a/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/jvntr-2009-12"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-0157"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa09-133a.html"
},
{
"trust": 0.6,
"url": "http://www.apple.com/macosx/"
},
{
"trust": 0.6,
"url": "/archive/1/499315"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht1338?viewlocale=en_us\u003e"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht3549\u003e"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht3550\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta09-133a.html\u003e"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34012/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32137/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20100/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34291/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33970/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29792/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl829/macosxserverupdcombo10.5.7.dmg"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl826/macosxupd10.5.7.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/try_vi/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/25350/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31384/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl818/secupd2009-002ppc.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34978/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31602/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl828/macosxserverupd10.5.7.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl819/secupdsrvr2009-002ppc.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34723/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/35074/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl827/macosxupdcombo10.5.7.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31450/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31558/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34347/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/35056/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl816/secupdsrvr2009-002univ.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31745/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33406/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32964/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34608/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31430/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/13968/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33318/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32560/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/downloads/dl817/secupd2009-002intel.dmg"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31478/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33338/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33404/"
},
{
"trust": 0.1,
"url": "http://www.nruns.com/security_advisory.php"
},
{
"trust": 0.1,
"url": "http://www.nruns.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-0157"
},
{
"trust": 0.1,
"url": "http://www.apple.com"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "PACKETSTORM",
"id": "77494"
},
{
"db": "PACKETSTORM",
"id": "77488"
},
{
"db": "PACKETSTORM",
"id": "77529"
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-37603"
},
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"db": "PACKETSTORM",
"id": "77494"
},
{
"db": "PACKETSTORM",
"id": "77488"
},
{
"db": "PACKETSTORM",
"id": "77529"
},
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-05-13T00:00:00",
"db": "VULHUB",
"id": "VHN-37603"
},
{
"date": "2009-05-12T00:00:00",
"db": "BID",
"id": "34926"
},
{
"date": "2009-05-12T00:00:00",
"db": "BID",
"id": "34958"
},
{
"date": "2009-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"date": "2009-05-14T05:04:45",
"db": "PACKETSTORM",
"id": "77494"
},
{
"date": "2009-05-13T08:47:30",
"db": "PACKETSTORM",
"id": "77488"
},
{
"date": "2009-05-15T18:26:13",
"db": "PACKETSTORM",
"id": "77529"
},
{
"date": "2009-02-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"date": "2009-05-13T15:30:00.437000",
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-08T00:00:00",
"db": "VULHUB",
"id": "VHN-37603"
},
{
"date": "2009-05-14T23:56:00",
"db": "BID",
"id": "34926"
},
{
"date": "2009-05-19T18:46:00",
"db": "BID",
"id": "34958"
},
{
"date": "2009-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001315"
},
{
"date": "2009-05-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200905-173"
},
{
"date": "2024-11-21T00:59:13.200000",
"db": "NVD",
"id": "CVE-2009-0157"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "34926"
},
{
"db": "BID",
"id": "34958"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Mac OS X of CFNetwork Vulnerable to buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001315"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200905-173"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.