CVE-2013-0984

published 2013-06-05

CVE-2013-0984: Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted…

Priority P2 58 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message.

Affected

126 ranges · showing 25

Vendor	Product	Version range	Fixed in
apple	mac_os_x	<= 10.6.8	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—
apple	mac_os_x	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 625↗

command Operation code 0x1172+1 with fDataSize=0x99999999 triggering buffer overflow in DSTCPEndpoint::AllocFromProxyStruct↗

path DirectoryService/DirectoryService-621/Proxy/DSTCPEndpoint.cpp↗

bytes↗

DSPX (packet header magic bytes)

bytes↗

DHN2 (handshake initiation magic bytes)

• → Monitor for inbound TCP connections to port 625 (DirectoryService) from untrusted/external sources; this port should not be exposed to the internet. ↗
• → Detect exploit packets by inspecting TCP payloads on port 625 for the magic header 'DSPX' followed by a 4-byte big-endian length field. ↗
• → Flag DirectoryService (DS) messages containing operation code 0x1173 (0x1172+1) with an anomalously large fDataSize value (e.g. 0x99999999) as potential exploitation attempts against DSTCPEndpoint::AllocFromProxyStruct. ↗
• → Alert on unexpected crashes or restarts of the DirectoryService daemon (directoryserviced), which may indicate exploitation attempts causing denial of service. ↗
• → The exploit uses AES-CBC encryption (PyCrypto) with a derived shared key to wrap the malicious payload; look for the DHN2 key-exchange initiation pattern at the start of the DS session as a precursor indicator. ↗

• · The vulnerability only affects Mac OS X Snow Leopard Server (10.6.x); OS X Lion and OS X Mountain Lion are not affected. ↗
• · The buffer overflow is triggered by controlling both 'inProxyDataMsg->fDataSize' and the copied data; sending a huge data size with a small buffer causes a crash on unmapped memory access, but Apple's own assessment was that reliable code execution may be difficult. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119