MacOSX 10.10.5 ftpd Resource Exhaustion (APPLE-SA-2015-09-30-3) *youtube

2013-04-10 / 2015-09-30
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-399


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

MacOSX 10.8.3 ftpd Resource Exhaustion Maksymilian Arciemowicz http://cxsecurity.org/ Public Date: 01.02.2013 http://cxsecurity.com/cveshow/CVE-2015-5917 http://cxsecurity.com/cveshow/CVE-2010-2632 http://cxsecurity.com/cveshow/CVE-2011-0418 Youtube: https://www.youtube.com/watch?v=MBK4QYkUm10 --- 1. Description --- Old vulnerability in libc allow to denial of service ftpd in MacOSX 10.8.3. Officially Apple has resolved this issue in Jun 2011. Apple use tnftpd as a main ftp server. tnftpd has migrated some functions from libc to own code (including glob(3)). Missing patch for resource exhaustion was added in version 20130322. To this time, we can use CVE-2010-2632 to denial of service the ftp server. The funniest is report http://support.apple.com/kb/ht4723 where CVE-2010-2632 was patched. That true 'libc is patched', but nobody from Apple has verified ftp. I really don't believe in penetrating testing form Apple side. Situation don't seems good. I has asked for open source donations, unfortunately Apple do not financial help vendors, what use their software in own products. Proof of Concept is available since 2010 http://cxsecurity.com/issue/WLB-2011030145 Video demonstrated how to kill Mac Mini in basic version i5 with 10GB RAM in 30 min is available on https://www.youtube.com/watch?v=MBK4QYkUm10 --- 2. References --- Multiple Vendors libc/glob(3) remote ftpd resource exhaustion http://cxsecurity.com/issue/WLB-2010100135 http://cxsecurity.com/cveshow/CVE-2010-2632 Multiple FTPD Server GLOB_BRACE|GLOB_LIMIT memory exhaustion http://cxsecurity.com/issue/WLB-2011050004 http://cxsecurity.com/cveshow/CVE-2011-0418 More CWE-399 resource exhaustion examples: http://cxsecurity.com/cwe/CWE-399 Last related to http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc --- 3. Contact --- Maksymilian Arciemowicz

References:

https://www.youtube.com/watch?v=MBK4QYkUm10
https://support.apple.com/en-us/HT205267
http://support.apple.com/kb/ht4723
http://cxsecurity.com/issue/WLB-2010100135
http://cxsecurity.com/cveshow/CVE-2010-2632
http://cxsecurity.com/issue/WLB-2011050004
http://cxsecurity.com/cveshow/CVE-2011-0418
http://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc
http://cxsecurity.com/issue/WLB-2011030145


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top