toggle

AAPL Stock: 111.28 ( + 1.87 )

Printed from http://www.macnn.com

iCal vulnerable to malicious .ics files

updated 04:05 pm EDT, Wed May 21, 2008

iCal vulnerable to bad ics

A new vulnerability in iCal has been discovered that allows un-authenticated attackers to execute arbitrary code on vulnerable systems with (and potentially without) the assistance from the end user of the application or to repeateadly execute a denial of service attack to crash the iCal application. Core Security writes that "the most serious of the three vulnerabilities is due to potential memory corruption resulting from an resource liberation bug that can be triggered with a malformed .ics calendar file specially crafted by a would-be attacker".

Interestingly enough, the other two vulnerabilities, which are also mildly serious, can lead to the iCal program crashing; caused by null-pointer dereference bugs triggered while parsing a malformed .ics files. The exploitation can be made when the user opens a specific .ics file crafted by the hacker to take advantage of any one of the three vulnerabilities.

The malicious file could either be hosted on a web server or e-mailed to the useras a standalone file. Until an official patch is available for download from Apple, iCal users are advised to only open .ics files from a known, verified source.




by MacNN Staff

POST TOOLS:

TAGS :

toggle

Comments

  1. MacDan2004

    Joined: Dec 1969

    +1

    MacCommonSense

    ...as is the case on any system with any file - why would you open a file from some unknown source?

  1. edinburghmac

    Joined: Dec 1969

    +3

    already fixed!

    If you read the article the problem is with iCal 3.0.1 on OS X 10.5.1. iCal was updated to 3.0.2 when OS X 10.5.2 came out (in February).

  1. testudo

    Joined: Dec 1969

    -5

    make sense...

    First, this is iCal. Who the h*** cares if iCal crashes???

    Second, a lot of people open files from unknown sources. How many web sites do you actually KNOW? I mean, really know. Because, truthfully, even MacNN could be taken over and run by a bunch of ne'er-do-wells bent on crashing your ical program. But you would say you "know" them.

    Third, it's an ics file. Who the h*** would rightly think "Wait, do I know who this came from? Maybe it's a trojan horse/virus". No one does that (esp because who would think an ics file could cause an issue, huh?).

    Fourth, to the "it's already fixed" crowd who always seem to want to make it sound like some problem isn't a problem because Apple 'fixed' it in some release.

    Keep in mind that not all Apple users are sheep (no, they really aren't, no matter how much you think they are). We don't all rush to our Update system and download every update Apple makes available the moment it becomes available. If your computer works perfectly fine, why would you risk an update that may or may not cause issues? Let the sheep download and install the update, and read the reports about what it breaks, what it fixes, and whether any of that is something that is important to you.

    So there are people who are running 10.4.7, or 10.3.3, or 10.5.1. Now they know there's another reason that updating to 10.5.2 might be worth it (albeit a really lame reason).

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

toggle

Most Popular

MacNN Sponsor

Recent Reviews

Dell AD211 Bluetooth speaker

For all of the high-priced, over-engineered Bluetooth speakers in the electronics market, there is still room for mass-market solution ...

VisionTek 128GB USB Pocket SSD

USB flash drives dealt the death blow to both the floppy and Zip drives. While still faster than either of the old removable media, sp ...

Kodak PixPro SL10 Smart Lens Camera

Smartphone imagery still widely varies. Large Megapixel counts don't make for a good image, and the optics in some devices are lackin ...

toggle

Most Commented