MacOSX 10.10.5 ftpd Resource Exhaustion (APPLE-SA-2015-09-30-3) *youtube

Published / (Updated)
Credit
Risk
2013-04-10 / 2015-09-30
Maksymilian Arciemowicz
Medium
CWE
CVE
Local
Remote
CWE-399
CVE-2015-5917
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial

MacOSX 10.8.3 ftpd Resource Exhaustion
Maksymilian Arciemowicz
http://cxsecurity.org/

Public Date: 01.02.2013
http://cxsecurity.com/cveshow/CVE-2015-5917
http://cxsecurity.com/cveshow/CVE-2010-2632
http://cxsecurity.com/cveshow/CVE-2011-0418

Youtube:
https://www.youtube.com/watch?v=MBK4QYkUm10

--- 1. Description ---
Old vulnerability in libc allow to denial of service ftpd in MacOSX 10.8.3. Officially Apple has resolved this issue in Jun 2011. Apple use tnftpd as a main ftp server. tnftpd has migrated some functions from libc to own code (including glob(3)). Missing patch for resource exhaustion was added in version 20130322.

To this time, we can use CVE-2010-2632 to denial of service the ftp server. The funniest is report

http://support.apple.com/kb/ht4723

where CVE-2010-2632 was patched. That true 'libc is patched', but nobody from Apple has verified ftp. I really don't believe in penetrating testing form Apple side. Situation don't seems good. I has asked for open source donations, unfortunately Apple do not financial help vendors, what use their software in own products.

Proof of Concept is available since 2010

http://cxsecurity.com/issue/WLB-2011030145

Video demonstrated how to kill Mac Mini in basic version i5 with 10GB RAM in 30 min is available on

https://www.youtube.com/watch?v=MBK4QYkUm10

--- 2. References ---
Multiple Vendors libc/glob(3) remote ftpd resource exhaustion
http://cxsecurity.com/issue/WLB-2010100135
http://cxsecurity.com/cveshow/CVE-2010-2632

Multiple FTPD Server GLOB_BRACE|GLOB_LIMIT memory exhaustion
http://cxsecurity.com/issue/WLB-2011050004
http://cxsecurity.com/cveshow/CVE-2011-0418

More CWE-399 resource exhaustion examples:
http://cxsecurity.com/cwe/CWE-399

Last related to
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc

--- 3. Contact ---
Maksymilian Arciemowicz



References:

https://www.youtube.com/watch?v=MBK4QYkUm10
https://support.apple.com/en-us/HT205267
http://support.apple.com/kb/ht4723
http://cxsecurity.com/issue/WLB-2010100135
http://cxsecurity.com/cveshow/CVE-2010-2632
http://cxsecurity.com/issue/WLB-2011050004
http://cxsecurity.com/cveshow/CVE-2011-0418
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc
http://cxsecurity.com/issue/WLB-2011030145


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com