Bug in Apple network framework

Stephen Withers
Saturday, 27 January 2007 15:27

Your IT - Home IT

An Apple framework used by network applications has an exploitable bug, claims the Month of Apple Bugs project.

According to LMH, the CFNetwork (a framework that provides abstractions for network protocols) fails to handle certain HTTP responses correctly, and sending such a response to an application using the framework is likely cause a crash.

Although this bug does not of itself allow the execution of arbitrary code, LMH says it can be combined with the privilege escalation vulnerability revealed on day 22.

No user-applicable workarounds are offered. Programmers are advised to add their own checking of HTTP responses, at least until Apple fixes the underlying issue.