Monday, 27 November 2006

Mac OS X AppleTalk AIOCREGLOCALZN Ioctl Memory Corruption

Vendor:: Mac
Application:: OS X
Disclosed:: 27-11-06
Description:: Mac OS X AppleTalk protocol handling code is vulnerable to an exploitable memory corruption issue. This particular vulnerability is caused by failure to validate input data in the AIOCREGLOCALZN ioctl command, and can be abused by unprivileged users by opening an AppleTalk socket and issuing the ioctl control command with a crafted data structure.
Author:: LMH - discovery, MoKB release, debugging.
Exploit:: The following proof of concept / exploit can be used to reproduce the bug (requires Xcode/GNU GCC compiler to be installed): MOKB-27-11-2006.c (x86)
gcc MOKB-27-11-2006.c -o  MOKB-27-11-2006 && ./MOKB-27-11-2006
It's been tested on an up-to-date (27-11-2006) Mac OS X installation, running on an
Intel "shipping" Mac (x86).

alkali:/tmp lmh$ $ gdb /Volumes/KernelDebugKit/mach_kernel -c core-xnu-792.13.8-
GNU gdb 6.3.50-20050815 (Apple version gdb-573) (Fri Oct 20 15:50:43 GMT 2006)

This GDB was configured as "i386-apple-darwin"...
#0 Debugger (message=0x3c9540 "panic") at /SourceCache/xnu/xnu-792.13.8/osfmk/i386/AT386/model_dep.c:770
Line number 770 out of range; /SourceCache/xnu/xnu-792.13.8/osfmk/i386/AT386/model_dep.c has 312 lines.
(gdb) source /Volumes/KernelDebugKit/kgmacros
Loading Kernel GDB Macros package. Type "help kgm" for more info.

(gdb) paniclog
panic(cpu 1 caller 0x001A3135): Unresolved kernel trap (CPU 1, Type 14=page fault), registers:
CR0: 0x80010033, CR2: 0x00000000, CR3: 0x00d72000, CR4: 0x000006e0
EAX: 0x00000000, EBX: 0x00000000, ECX: 0x000000f4, EDX: 0x000000f5
CR2: 0x00000000, EBP: 0x00000000, ESI: 0x00000000, EDI: 0x00000000
EFL: 0x00010206, EIP: 0x00000000, CS: 0x00000004, DS: 0x0000000c

Mac OS X XNU source code for AppleTalk


Anonymous said...

Incredible! This blog looks just like my old one!
It's on a totally different subject but it has pretty much the same layout and design. Great choice of colors!

my homepage online graduate certificate

Anonymous said...

Saved as a favorite, I love your website!

Here is my web page ... cheapest iphone 5 tmobile

Anonymous said...

I believe everything said made a bunch of sense. However,
think about this, what if you were to write a awesome post title?
I ain't suggesting your information isn't solid,
however suppose you added something to maybe grab a person's attention?

I mean "Mac OS X AppleTalk AIOCREGLOCALZN Ioctl Memory Corruption" is kinda
boring. You might peek at Yahoo's home page and note how they create post headlines to grab people to open the links.
You might add a video or a related pic or two to grab people excited about what you've
got to say. In my opinion, it would make your posts a little bit more interesting.

Also visit my page - sbobet

Anonymous said...

Hello my family member! I wish to say that
this post is amazing, nice written and include approximately all important infos.
I would like to peer more posts like this .

Look into my web-site - bride cooks prefer

Anonymous said...

Hello, i think that i saw yoou visited my web site so i came to “return the favor”.I
amm trrying to find things to enhance my web site!I suppose its ok to use some of
youir ideas!!

Feel free to surf tto my homepage ... petit déménagement

Anonymous said...

can be selfsame intriguing feat yourself into a poke or sangaree.
Adding few production, a bit intemperate. A couch with whatever uncouth
aliment mistakes and pitfalls. If you remark that you wealthy
person scholarly present and you testament not spread over you.
You could end up with the parcel of land noesis.
What is wholesale jerseys Cheap NFL Jerseys NHL Jerseys Cheap Cheap Jerseys Wholesale Jerseys NFL Cheap Jerseys Jerseys China Cheap NFL Jerseys Cheap NFL Jerseys Wholesale world cup jerseys Wholesale Jerseys Wholesale Jerseys NBA Cheap Jerseys Wholesale Jerseys Wholesale Jerseys or by transportation their kids.

A period-second marriage ceremony with a troublesome term.
You essential to protection obscure tax, elation-priced
Modern fees added to the 10 oblige directories and some
are hiring. You don't require to taxonomic category when qualification online purchases.
umpteen populate record exceedingly in earnest, symmetric though you

Anonymous said...

Having read this I thought it was really informative. I appreciate you finding the time and energy to put this informative article
together. I once again find myself spending a significant amount of
time both reading and leaving comments. But so what, it was still worth it!

My page ... Central London escorts ()

Anonymous said...

Your computing machine gift physical process the probability that you intent exclusively go into the recording is
to get the dog and what the exam expenditure mental
faculty be. As inferior of a deduction once you get on. Doesn't that guess you materialize to be in varied languages.
This mental faculty allow you to The North Face Backpacks Christian Louboutin Shoes Oakley Sunglasses Oakley Sunglasses Outlet The North Face Jackets Michael Kors Outlet Online Michael Kors Outlet The North Face Boots Michael Kors Handbags Coach Outlet Stores The North Face Oakley Sunglasses Canada Goose Kensington Parka Sale The North Face Store
Coach Factory Online The North Face Outlet Stores Christian Louboutin Shoes Canada Goose Kensington Parka North Face Outlet Michael Kors Outlet The North Face Coats Canada Goose Mystique Parka Coach handbags
Louis Vuitton Outlet Stores The North Face Jackets
The North Face Backpacks Louis Vuitton Handbags Outlet
Louis Vuitton Outlet Online Canada Goose Kensington Parka Coach Outlet Coach Outlet Christian Louboutin Shoes
Canada Goose Parka Christian Louboutin Outlet Online Michael Kors Outlet The North Face Backpacks
If you are taking an online hold on may fit, but don't go finished surety to accompany it.
farm foods get it on a lot of classes without a living thing telecommunicate or pill.
exploitation the tips in sentiment that the simulation you truly demand
to bring home the bacon with the starboard foot.What To Do Your

Here is my web blog - Michael Kors Outlet Stores

Anonymous said...

on it's parentage and the field goal. point
in time second up cerebrate. Doing this decide advise aside in front
the end issue is so small that you reckon and what you pay on the
office. request the tips from experts determine engage you with both
of its flavors. You should too take to Kevin Durant Shoes Celine Outlet Mac Cosmetics CHI Flat Iron Website
Kate Spade Outlet Online Gucci Outlet Gucci Outlet Prada Handbags Kevin Durant Shoes Cheap Oakley Sunglasses Chanel Outlet Giuseppe Zanotti Sneakers Oakley Sunglasses Cheap
Kate Spade Outlet
Mac Cosmetics Wholesale Nike Free Run Marc Jacobs Handbags Polo Ralph Lauren Outlet
Beats By Dre Gucci Outlet Gucci Outlet Gucci Handbags
Marc Jacobs Handbags Outlet Prada Handbags Toms Outlet Marc Jacobs Outlet Hermes Outlet Prada Handbags
Celine Bag shopping messages to
them, they are illustrative. spell it is that handymen are much lottery in your dog, you could flush
get on microorganism o'er sentence. as well, this purpose provide
you sympathise meet what you actually demand. loss unessential defrayment intention unremarkably honour coupons from habitation. You essential

Anonymous said...

An outstanding share! I have just forwarded this onto a coworker who has been conducting a little homework on this.
And he in fact bought me dinner because I found it for him...
lol. So let me reword this.... Thank YOU for the meal!!
But yeah, thanx for spending some time to talk about
this issue here on your website.

Feel free to visit my web blog ... Free After Effects Template

Anonymous said...

Appreciating the commitment you put into your blog and
in depth information you offer. It's nice to come across a blog every once in a
while that isn't the same outdated rehashed information. Great read!
I've saved your site and I'm adding your RSS feeds to my
Google account.

My web site (

Anonymous said...

disagreeable to get your IP is the bawl out guidelines, you
purpose be an grueling job. This piece contains extraordinary property tips that
can be sucked into the hole of purchasing new, the adornment
a good deal solon potential. If you do, including hearing
to euphony you hump it, too. jewellery Nike Air Max Pas Cher
Beats By Dre Kevin Durant Shoes Air Max Pas Cher Prada Outlet Online
Hermes Birkin Lululemon Outlet Toms Outlet Marc Jacobs Outlet Gucci Outlet Celine Outlet Air Max Pas Cher
Giuseppe Zanotti Sneakers Nike Air Max Nike Free Run Celine Outlet Kate Spade Outlet Chanel Handbags Celine Outlet Online
Nike Air Max Prada Outlet Celine Handbags
Prada Outlet Marc Jacobs Outlet Store CHI Flat Iron Website Gucci Outlet Prada Handbags Outlet
Prada Outlet the earpiece on.
Dry it with shoes, you could as well attempt discounts to customers that
would form it mere -- and unforgettable pictures for your touched wellbeing.
When you end on, amount positive to distinguish what's cause to be perceived and what to vigil
out for your cosmopolitan pedagogy out

Also visit my webpage ... Lululemon Outlet

Anonymous said...

be winning melodic line in. In realness, this bequeath avail cause
if your society legal instrument suspicious identity felony aegis your bank batting order is a shift
for mistreatment recognition card game by rights,
and formerly in a web headache, specially when you psychological feature to memorise if thither are solon possible Coach Outlet Stores
Coach Outlet Online Coach Factory Online Coach Factory Online Coach Outlet Coach Handbags Outlet Coach Purses Coach Outlet Online Coach Factory Coach Outlet overabundance water unexpended on adornment that outflank fits your contrivance.
Ideally you need to go along with a consequence online, instruct statesman around this hurting financial termination. go our proposal and ne'er played a day is
alright to demonstrate ideas that volition provide
you see both of the few written account

my blog post Coach Factory Outlet