Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X 10.11 buffer overflow with deep filesystem hierarchy

cxsecurity.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#31

Post by acdha »

thesorrow wrote: post #24

Seems like there's a lot more vuln with OSX in the last few releases. I'm still using OSX for basic stuff like browsing but I rely on a linux VM to do the serious stuff. I know that my vm can be compromised if the host system is vulnerable but I feel safer.

Have you considered how much of that might be due to Apple's takeover of the consumer space? There were fewer people looking for exploits and even fewer reporters covering them before they became the OS of choice for hundreds of millions of people.

If you believe Linux is that much better, well, you really ought to follow your distribution's security announcement list. Nobody in the general computing space has a track record which entitles them to cast aspersions at the competition.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#32

Post by msbarnett »

geofft wrote: post #29
the_mitsuhiko wrote: post #9

Earlier quoted context omitted.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

Does that affect regular OS X desktops/laptops? It makes sense for Apple TVs and iOS devices (well, as much sense as locking them down in the first place) but for OS X, the anti-TiVoization clause merely requires that the end user be able to replace those binaries. And there's always a way to turn off System Integrity Protection. Or are they worried about something else, like the patent clauses?

The patent clauses. They're so vague and untested a lot of corporate lawyers balk at having anything to do with them.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#33

Post by raimue »

userbinator wrote: post #14

The article references http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/g... but there's nothing that particularly stands out as being the bug at a quick glance and it is designed to handle arbitrarily deep hierarchies; nonetheless this looks like an off-by-one to me (in fts_alloc): len = sizeof(FTSENT) + namelen; if (!ISSET(FTS_NOSTAT)) len += sizeof(struct stat) + ALIGNBYTES; if ((p = malloc(len)) == NULL…

Interestingly, this is actually the Libc code of OS X 10.10.5 Yosemite. Source code for OS X 10.11 El Capitan has not yet been released by Apple.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#34

Post by belorn »

the_mitsuhiko wrote: post #9
trengrj wrote: post #8

Earlier quoted context omitted.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

Apple could agree to any software licenses they wish, but they choose not to with GPLv3. There is nothing legally that prevent them from giving users access to source code, nor giving users permission to change software running on devices that they have bought from Apple.

Apple refuse to do this. No one know for sure but the common suspicion is that they want to avoid competition by locking users to a single platform where apple has a artificial created monopoly.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#35

Post by mitchty »

autoreleasepool wrote: post #18
Someone wrote: post #17

Earlier quoted context omitted.

I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization ( https://en.m.wikipedia.org/wiki/Tivoization ) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. App…

I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license. I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.

It was the primary shell in 10.2 or 10.3 after tcsh or csh (its been a while I can't remember well).

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#36

Post by dogma1138 »

huuu wrote: post #6
reilly3000 wrote: post #3

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

What about sending someone a zip with such a directory structure?

That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance.

commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#37

Post by matt4077 »

belorn wrote: post #34
the_mitsuhiko wrote: post #9

Earlier quoted context omitted.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

Apple could agree to any software licenses they wish, but they choose not to with GPLv3. There is nothing legally that prevent them from giving users access to source code, nor giving users permission to change software running on devices that they have bought from Apple. Apple refuse to do this. No one know for sure but the common suspicion is that they want to avoid competition by locking users to a single platform…

Or maybe they just don't want to give away one of their core products for free.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#38

Post by anonbanker »

just_curioussss wrote: post #26
userbinator wrote: post #25

Earlier quoted context omitted.

ALIGNBYTES is probably 3 or 7, depending on what ALIGN does, but the +2 seems like a bug to me. I think the intended layout is [FTSENT][name][0][optional [possible alignment padding][struct stat]] which means that +2 should really be a +1. The total memory allocated should be sizeof(FTSENT) + namelen + 1 + (padding + sizeof(struct stat)) (I Googled 'site:opensource.apple.com "#define ALIGNBYTES" inurl:.h' and got my…

I found a couple different definitions: https://opensource.apple.com/source/OpenSSH/OpenSSH-95/opens... https://opensource.apple.com/source/xnu/xnu-792.13.8/bsd/ppc... https://opensource.apple.com/source/sendmail/sendmail-32/sen... They align toward the higher address.

so the +2 is indeed out of bounds?

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#39

Post by anonbanker »

matt4077 wrote: post #37
belorn wrote: post #34

Earlier quoted context omitted.

Apple could agree to any software licenses they wish, but they choose not to with GPLv3. There is nothing legally that prevent them from giving users access to source code, nor giving users permission to change software running on devices that they have bought from Apple. Apple refuse to do this. No one know for sure but the common suspicion is that they want to avoid competition by locking users to a single platform…

Or maybe they just don't want to give away one of their core products for free.

yeah, best not use free software if you get the willies from the word "free".

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#40

Post by anonbanker »

hedwall wrote: post #16
the_mitsuhiko wrote: post #9

Earlier quoted context omitted.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?

if someone uses your software in a way that is honoring the GPLv3, but you don't like, you lose any ability to sue or further restrict them. Even though the ghost of Steve Jobs (Forstall) is no longer haunting the building, Apple learned the lesson of "sue early, sue often", and Stallman/Moglen sort of got in the way of that with GPLv3.

Tivoization was another issue, especially with Apple's tendency to lock down their platform.

Post reply on HN