National Cyber Awareness System

Vulnerability Summary for CVE-2009-1235

Overview

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-218A

Name: TA09-218A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-218A.html

External Source: VUPEN

Name: ADV-2009-2172

Hyperlink:http://www.vupen.com/english/advisories/2009/2172

External Source: VUPEN

Name: ADV-2009-0822

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/0822

External Source: SECTRACK

Name: 1022671

Hyperlink:http://www.securitytracker.com/id?1022671

External Source: BID

Name: 34203

Hyperlink:http://www.securityfocus.com/bid/34203

External Source: MILW0RM

Name: 8266

Hyperlink:http://www.milw0rm.com/exploits/8266

External Source: MISC

Name: http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181

Hyperlink:http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181

External Source: MISC

Name: http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.sh

Hyperlink:http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.sh

External Source: MISC

Name: http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.c

Hyperlink:http://www.digit-labs.org/files/exploits/xnu-hfs-fcntl-v2.c

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3757

Hyperlink:http://support.apple.com/kb/HT3757

External Source: SECUNIA

Name: 36096

Hyperlink:http://secunia.com/advisories/36096

External Source: SECUNIA

Name: 34424

Hyperlink:http://secunia.com/advisories/34424

External Source: APPLE

Name: APPLE-SA-2009-08-05-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html