May 14th, 2009
Apple eliminates CanSecWest Pwn2Own flaws
Here’s a little ditty that was almost lost in the sheer volume of this week’s Mac OS X security update: Apple has finally patched the two vulnerabilities used to win this year’s CanSecWest Pwn2Own hacking contest.
The two flaws were used by Charlie Miller and a German researcher known only as “Nils” to launch successful drive-by download attacks against Apple’s Safari browser.
[ SEE: Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari ]
However, according to Apple’s release notes, the bug exploited by Miller actually affected ATS (Apple Type Services).
- ATS (CVE-2009-0154): A heap buffer overflow exists in Apple Type Services’ handling of Compact Font Format (CFF) fonts. Viewing or downloading a document containing a maliciously crafted embedded CFF font may lead to arbitrary code execution. This update addresses the issue through improved bounds checking.
The vulnerability used during Nils’ exploit affected WebKit:
- CVE-2009-0945: A memory corruption issue exists in WebKit’s handling of SVGList objects. Visiting a maliciously crafted website may lead to arbitrary code execution. This update addresses the issue through improved bounds checking.
Mozilla was the first to issue a fix for its Pwn2Own embarrassment. Microsoft is yet to fix the vulnerability that was exploited via Internet Explorer.
ALSO SEE:
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
