CVE-2007-4268
published 2007-11-15CVE-2007-4268: Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted…
PriorityP428high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.67%
48.5th percentile
Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk message with a negative value, which satisfies a signed comparison during mbuf allocation but is later interpreted as an unsigned value, which triggers a heap-based buffer overflow.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | 10.4.0 – 10.4.10 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Access of Memory Location After End of Buffer
mitre_cwe
CWE-788 Access of Memory Location After End of Buffer
CWE-788: Access of Memory Location After End of Buffer
The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
This typically occurs when a pointer or its index is incremented to a position after the buffer; or when pointer arithmetic results in a position after the buffer.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory. For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffer's position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Scope: Integrity, Availability. Impact: Modify Memory, DoS:
CWE
Heap-based Buffer Overflow
mitre_cwe
CWE-122 Heap-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory). Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Scope: Integrity, Confidentiality, Availability, Access Control. Impact: Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Modify Memory. Buffer overflows often can be used to e
CWE
Out-of-bounds Write
mitre_cwe
CWE-787 Out-of-bounds Write
CWE-787: Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity. Impact: Modify Memory, Execute Unauthorized Code or Commands. Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Scope: Other. Impact: Unexpected State. Subsequent write operations can produce undefined or unexpected results.
Detection Methods:
Automated Static Analysis: This weakness can often be detected using automated s
CWE
Signed to Unsigned Conversion Error
mitre_cwe
CWE-195 Signed to Unsigned Conversion Error
CWE-195: Signed to Unsigned Conversion Error
The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
It is dangerous to rely on implicit casts between signed and unsigned numbers because the result can take on an unexpected value and violate assumptions made by the program. Often, functions will return negative values to indicate a failure. When the result of a function is to be used as a size parameter, using these negative return values can have unexpected results. For example, if negative size values are passed to the standard memory copy or allocation functions they will be implicitly cast to a large unsigned value. This may lead to
CWE
Incorrect Conversion between Numeric Types
mitre_cwe
CWE-681 Incorrect Conversion between Numeric Types
CWE-681: Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Other, Integrity. Impact: Unexpected State, Quality Degradation. The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of
http://docs.info.apple.com/article.html?artnum=307041http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.htmlhttp://secunia.com/advisories/27643http://securitytracker.com/id?1018950http://www.securityfocus.com/bid/26444http://www.us-cert.gov/cas/techalerts/TA07-319A.htmlhttp://www.vupen.com/english/advisories/2007/3868https://exchange.xforce.ibmcloud.com/vulnerabilities/38476http://docs.info.apple.com/article.html?artnum=307041http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.htmlhttp://secunia.com/advisories/27643http://securitytracker.com/id?1018950http://www.securityfocus.com/bid/26444http://www.us-cert.gov/cas/techalerts/TA07-319A.htmlhttp://www.vupen.com/english/advisories/2007/3868https://exchange.xforce.ibmcloud.com/vulnerabilities/38476
2007-11-15
Published