Check Point Advisories

Apple Computer Finder DMG Volume Name Memory Corruption (CVE-2007-0197)

Vulnerability
Protection

Check Point Reference:	CPAI-2007-217
Date Published:	5 Oct 2009
Severity:	High
Last Updated:	Sunday 14 February, 2016
Source:
Industry Reference:	CVE-2007-0197
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Apple Computer Mac OS X is the operating system bundled with Apple Macintosh computers. The graphical user interface shell of Mac OS X, Finder, allows for graphical browsing of the system. The Finder is also responsible for user-management of files, disks, network volumes and the launching of other applications. There exists a memory corruption vulnerability in the Apple Finder product. The flaw is due to improper bounds checking on the length of the Volume name in the DMG disk images. An attacker may exploit this vulnerability by enticing a user to open a crafted DMG disk image. Exploitation of the vulnerability may result in injection and execution of arbitrary code within the security context of the target user. In an attack scenario, where arbitrary code is attempted to be injected and executed on the target machine, the behaviour of the target is dependent on the intention of the malicious code. If such an attack fails to execute successfully, or intended for denial of service, the vulnerable application may terminate or become unresponsive as a result of the exploitation. It has been observed once the Finder application is terminated due to the created denial of service condition, the application attempts to restart itself. It, however, will likely attempt to restore the mounting of the malicious DMG file and will be terminated again. This will cause a non-terminating termination and restart process which can only be stopped via external termination of the process or via logout.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Apple Computer Finder DMG Volume Name Memory Corruption protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Content Protection Violation.
Attack Information: Apple Computer Finder DMG volume name memory corruption