PT-2007-2072 · Apple · Ichat+3

Published 2007-01-31 · Updated 2008-09-05 · CVE-2007-0614

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions mDNSResponder version not specified Apple Mac OS X version 10.4.8 iChat version 3.1.6 InstantMessage framework version 428

Description The issue allows remote attackers to cause a denial of service, resulting in a persistent application crash. This is achieved by sending a crafted phsh hash attribute in a TXT key.

Recommendations For Apple Mac OS X version 10.4.8, consider disabling the Bonjour functionality as a temporary workaround until a patch is available. For iChat version 3.1.6, restrict the use of the InstantMessage framework to minimize the risk of exploitation. For mDNSResponder, avoid using crafted phsh hash attributes in TXT keys until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0614

Affected Products

Instantmessage Framework

Macos X

Ichat

Mdnsresponder

References · 10

• 🔥 http://securityfocus.com/bid/22304 · Exploit
• 🔥 http://projects.info-pull.com/moab/MOAB-29-01-2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/3230 · Exploit
• http://lists.apple.com/archives/Security-announce/2007/Feb/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0614 · Security Note
• http://secunia.com/advisories/23945 · Note
• http://osvdb.org/32713 · Note
• http://securitytracker.com/id?1017661 · Note
• http://secunia.com/advisories/24198 · Note
• http://docs.info.apple.com/article.html?artnum=305102 · Note