MOAB-13-01-2007: Apple DMG HFS+ do_hfs_truncate() Denial of Service Vulnerability

A specially crafted HFS+ filesystem in a DMG image can cause the do_hfs_truncate() function to panic the kernel (denial of service), when attempting to remove a file from the mounted filesystem. This issue can't lead to arbitrary code execution, although there's a significant risk of local HFS+ filesystems corruption.

Further information:

• MOAB-13-01-2007
• Proof of concept image: MOAB-13-01-2007.dmg.gz

MOAB-12-01-2007: Apple DMG UFS ufs_lookup() Denial of Service Vulnerability

A specially crafted UFS filesystem in a DMG image can cause the ufs_lookup() function to call ufs_dirbad() when a corrupted directory entry is being read, leading to a kernel panic (denial of service).

For further information:

• Apple DMG UFS ufs_lookup() Denial of Service Vulnerability
• Proof of concept: MOAB-12-01-2007.dmg.gz

We would like to thank evan1138 for his generous donation to the project, as well as his constructive feedback and comments.

MOAB-11-01-2007: Apple DMG UFS byte_swap_sbin() Integer Overflow Vulnerability

The byte_swap_sbin() function, one of the UFS byte swapping routines (this code isn't present in FreeBSD and it's Mac OS X XNU-specific; used for compatibility of filesystem streams between little and big-endian systems) is affected by a integer overflow vulnerability, leading to an exploitable denial of service condition.

For further information:

• Apple DMG UFS byte_swap_sbin() Integer Overflow Vulnerability
• Proof of concept: MOAB-11-01-2007.dmg.gz

You may have noticed some changes. As KF would say, "we are more respectable now". The issues will still feature hilarious artwork by talented fellow GC. Enjoy.

MOAB-10-01-2007: Apple DMG UFS ffs_mountfs() Integer Overflow Vulnerability

The ffs_mountfs() function, part of the UFS filesystem handling code (shared between FreeBSD and Mac OS X XNU) is affected by an integer overflow vulnerability, leading to an exploitable denial of service condition and potential arbitrary code execution.

For further information:

• Apple DMG UFS ffs_mountfs() Integer Overflow Vulnerability
• Proof of concept: MOAB-10-01-2007.dmg.gz

Note: Apple requested confirmation more than one month ago, when the original FreeBSD UFS vulnerabilities got published in the MoKB. This serves as confirmation that the issues obviously exist in both XNU and FreeBSD. It wasn't that difficult to verify, given that the UFS code is exactly the same in both.

We'll be releasing kernel-related issues for some time (mixed with remote user-land issues, just to keep it fun). Mostly DMG related flaws that didn't make it to the MoKB schedule.

MOAB-09-01-2007: Apple Finder DMG Volume Name Memory Corruption

Finder is affected by a memory corruption vulnerability, which leads to an exploitable denial of service condition and potential arbitrary code execution, that can be triggered by DMG images.

For further information:

• Apple Finder DMG Volume Name Memory Corruption
• MOAB-09-01-2007.rb and MOAB-09-01-2007.dmg (x86).