OS X 10.11 buffer overflow with deep filesystem hierarchy

#1

Post by ivank » Sat, Oct 24, 2015, 3:58 AM UTC

OS X 10.11 buffer overflow with deep filesystem hierarchy
cxsecurity.com

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#2

Post by zwp » Sat, Oct 24, 2015, 8:23 AM UTC

Since this doesn't cause a system panic... multiple userland utilities have MAXPATHLEN problems? Is this reproducible with longer filenames and less depth? (If not: what cares about depth?)

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#3

Post by reilly3000 » Sat, Oct 24, 2015, 8:41 AM UTC

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#4

Post by Alphasite_ » Sat, Oct 24, 2015, 8:51 AM UTC

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#5

Post by tajen » Sat, Oct 24, 2015, 9:25 AM UTC

Alphasite_ wrote: post #4

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?

Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2].

[1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros

[2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#6

Post by huuu » Sat, Oct 24, 2015, 9:56 AM UTC

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

What about sending someone a zip with such a directory structure?

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#7

Post by devit » Sat, Oct 24, 2015, 10:16 AM UTC

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#8

Post by trengrj » Sat, Oct 24, 2015, 10:27 AM UTC

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#9

Post by the_mitsuhiko » Sat, Oct 24, 2015, 10:40 AM UTC

trengrj wrote: post #8

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code

They do not refuse, they cannot include it from a legal point of view.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#10

Post by tedunangst » Sat, Oct 24, 2015, 10:55 AM UTC

trengrj wrote: post #8

reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

So all BSD systems have the same bug??