Teil 4 der Apple Bugs sind veröffentlicht. Dieses Mal handelt es sich um einen Fehler in den XML-Feeds der iPhoto Photocasts:
"By creating a crafted iPhoto photocast XML feed, a malicious user (in this example, infamous Johnny Pwnerseed) could abuse a format string vulnerability in the handling of the "title" element, potentially leading to a remote arbitrary code execution condition.
Once Aunt Sophia subscribes, the malicious feed is automatically downloaded into a "Johnny Pwnerseed's Latest Pics" album that instantly triggers the issue."
Wie üblich werden die Bugs sofort mit dem passenden Exploits serviert, Script-Kiddies könnten sich dann gleich mal ans Basteln machen.
"The provided proof of concept launches a fake HTTP service which will serve the XML payload to any iPhoto user connecting. If the user-agent isn't iPhoto, it will send garbage instead. For a more elaborate POC, you can modify it to take iPhoto version into account. Requires a working Ruby interpreter and capability to use the port 80 (as iPhoto apparently rejects any other port)"
Als Tipp zum Schutz empfehlen die Hacker:
"Don't trust Johnny Pwnerseed, Aunt Sophia's or other unknown users photocasts (as the risk is more than just being a victim of the Goatse meme). Don't try to subscribe to them without checking first that the feed doesn't contain a malicious payload."
