toggle

AAPL Stock: 502.21 ( 0 )

Security flaws surface in Leopard, VPN

updated 05:25 pm EST, Mon December 10, 2007

Security flaws in Leopard


A new denial of service (DoS) vulnerability has surfaced in Apple's Mac OS X Leopard operating system that can result in crashes, according to Heise Security. The flaw, which is an integer overflow in the load_threadstack function in mach_loader.c, occurs when processing Mach-O binaries and can lead to a kernel panic. Single user systems should not be at risk, according to the company, but multi-user setups are vulnerable because attackers do not require any special privileges to provoke the error.

Additionally, security website digit-labs.org has reported a DoS vulnerability in the VPN (Virtual Private Network) service in Mac OS X 10.5 where maliciously-crafted packets can cause the service to freeze. Demonstration exploits are available for both flaws, and no patches have been released to correct the problems.


by MacNN Staff

toggle

Comments

  1. robttwo

    Fresh-Faced Recruit

    Joined: Nov 2005

    0

    hei(bs)e

    Heise must have a team of people doing nothing but trying to find ways to crash OSX.

    None of this c*** they publish is in the wild - they are all (wow, what a surprise) only in their own lab. Now, if they were actually an ethical company they would notify Apple of the problem and allow them to issue a notice or make corrections - instead of using their self-made flaws as a way to extend their own business.

    Doofuses.

  1. chefpastry

    Mac Enthusiast

    Joined: Nov 2005

    0

    Well said, Doofuses.

    I'd also like to point out that there are obviously many people trying their darndest to find vulnerabilities. It's good to see that none have managed to gain control of someone else's Mac yet.

  1. UberFu

    Fresh-Faced Recruit

    Joined: Oct 2002

    0

    that explains

    what happened the other day_ Except that I was merely trying to access the internet and my system crashed_ I don't think I was hacked" per se_

    BUT Leopard is buggy as hell_

    Oh yeah - has anyone found out who this no-name company that keeps feeding MacNN retarded info about OS X actually is? This is their claim to fame? 2 mentions of OS X flaws in a couple of weeks_ Also seems like MacNN are the only folks reporting these Heise found vulnerabilities_

    MacNN - how much are they paying you to run their news story? Really! It's okay - you can tell us - we won't rat you out_

  1. UberFu

    Fresh-Faced Recruit

    Joined: Oct 2002

    0

    oh i just saw it

    MacNN dawned Heise's Logo finally - Wow! Not impressed_

  1. testudo

    Fresh-Faced Recruit

    Joined: Aug 2001

    0

    Re: hei(bs)e

    None of this c*** they publish is in the wild - they are all (wow, what a surprise) only in their own lab.

    Where would you rather the exploit potentials be found, when it reaches the wild?

    And where do you think most of the Windows vulnerabilities are found? In the wild? No, usually by hackers/groups looking for vulnerabilities to report them, not to exploit them.

  1. dtich

    Fresh-Faced Recruit

    Joined: Dec 2007

    0

    10.5 is *not* "buggy as

    h***". there are some bugs, to be sure. buggy as h***, well, that seems patently untrue, not just a silly exaggeration.

    and, agree on all the heise comments. losers. i'm glad people are hacking and poking at leopard, but... every little stack overflow they can evoke doesn't require a bloody press release. if we look close enough, i'm sure we'll find a nice stack of microsoft checks stubs in heise's bank accounts...

Login Here

Not a member of the MacNN forums? Register now for free.

 
close
Photo
toggle

Network Headlines

toggle

Most Popular

10 Most Read

Recent Reviews

Powerbag Business Class Bag

Many companies currently offer battery packs and various accessories to keep smartphones and other gadgets charged when away from an o ...

Logitech Cube

The world of mice could often be described charitably as stagnant: it's an endless sea of ergonomic shapes that assume you're sitting ...

NewerTech and Targus USB Hubs For Gifts

A useful holiday present to resolve an ongoing frustration is a multi-port hub. Whether as a stocking stuffer, Chanukah present, or an ...

toggle

Most Commented

10 Most Discussed