AAPL Stock: 108.64 ( -2.14 )

Printed from

iCal vulnerable to malicious .ics files

updated 04:05 pm EDT, Wed May 21, 2008

iCal vulnerable to bad ics

A new vulnerability in iCal has been discovered that allows un-authenticated attackers to execute arbitrary code on vulnerable systems with (and potentially without) the assistance from the end user of the application or to repeateadly execute a denial of service attack to crash the iCal application. Core Security writes that "the most serious of the three vulnerabilities is due to potential memory corruption resulting from an resource liberation bug that can be triggered with a malformed .ics calendar file specially crafted by a would-be attacker".

Interestingly enough, the other two vulnerabilities, which are also mildly serious, can lead to the iCal program crashing; caused by null-pointer dereference bugs triggered while parsing a malformed .ics files. The exploitation can be made when the user opens a specific .ics file crafted by the hacker to take advantage of any one of the three vulnerabilities.

The malicious file could either be hosted on a web server or e-mailed to the useras a standalone file. Until an official patch is available for download from Apple, iCal users are advised to only open .ics files from a known, verified source.

by MacNN Staff



  1. MacDan2004

    Joined: Dec 1969


    MacCommonSense is the case on any system with any file - why would you open a file from some unknown source?

  1. edinburghmac

    Joined: Dec 1969


    already fixed!

    If you read the article the problem is with iCal 3.0.1 on OS X 10.5.1. iCal was updated to 3.0.2 when OS X 10.5.2 came out (in February).

  1. testudo

    Joined: Dec 1969


    make sense...

    First, this is iCal. Who the h*** cares if iCal crashes???

    Second, a lot of people open files from unknown sources. How many web sites do you actually KNOW? I mean, really know. Because, truthfully, even MacNN could be taken over and run by a bunch of ne'er-do-wells bent on crashing your ical program. But you would say you "know" them.

    Third, it's an ics file. Who the h*** would rightly think "Wait, do I know who this came from? Maybe it's a trojan horse/virus". No one does that (esp because who would think an ics file could cause an issue, huh?).

    Fourth, to the "it's already fixed" crowd who always seem to want to make it sound like some problem isn't a problem because Apple 'fixed' it in some release.

    Keep in mind that not all Apple users are sheep (no, they really aren't, no matter how much you think they are). We don't all rush to our Update system and download every update Apple makes available the moment it becomes available. If your computer works perfectly fine, why would you risk an update that may or may not cause issues? Let the sheep download and install the update, and read the reports about what it breaks, what it fixes, and whether any of that is something that is important to you.

    So there are people who are running 10.4.7, or 10.3.3, or 10.5.1. Now they know there's another reason that updating to 10.5.2 might be worth it (albeit a really lame reason).

Login Here

Not a member of the MacNN forums? Register now for free.


Network Headlines

Follow us on Facebook


Most Popular


Recent Reviews

Polk Hinge Wireless headphones

Polk, a company well-established in the audio market, recently released a new set of headphones aimed at the lifestyle market. The Hin ...

Blue Yeti Studio

Despite being very familiar with Blue Microphones' lower-end products -- we've long recommended the company's Snowball line of mics ...

ZTE Spro 2 Smart Projector

Home theaters are becoming more and more accessible these days, but maybe you've been a bit wary about buying a home projector. And h ...


Most Commented