mac osx- admin service buffer overflow

I discovered that by netcatting/telneting/otherwise sending 2057 A's to port 610 (admin service) of an osx server box that the serivce will crash and restart. I infered that the buffer must be set at 2056 charactors. I was only able to test this on one bo
x, and I was not able to get on it and dump memory, etc as it was a friends. A was also unable to make a shellcode for this, but that's because of my not-quite-elite knowlage, not that it's impossible.

I notified Mac about 4 weeks ago, no response and no patch.

Thanks and sorry I can't give more info,

-Jack C ("crEp")
crep@triviasecurity.net
http://www.crepinc.com

In-Reply-To: <20040318232447.29522.qmail@search.securityfocus.co m>

As several people have asked, I will post the following:

1) I beleive the version was 10.3, SERVER
2) The service did not have a header or anything, however nmap reported it as "osx-admin"
3) I'm very sorry, I misstyped the port last time, it is 660 not 610.

-Jack C ("crEp")
crep@triviasecurity.net
http://www.crepinc.com

[Mathias Wegner]

> 1) I beleive the version was 10.3, SERVER
> 2) The service did not have a header or anything, however nmap reported it as "osx-admin"
> 3) I'm very sorry, I misstyped the port last time, it is 660 not 610.

From Panther (10.3.3) /etc/services,

mac-srvr-admin 660/udp # MacOS Server Admin
mac-srvr-admin 660/tcp # MacOS Server Admin

It's the GUI admin tool for OS X server (think webmin or the like, but OS X). Google
for MacOS Server Admin for details on it, or take a look at the "getting started"
pdf under http://www.apple.com/server/documentation/


Mathias

--

I don't want the world, I just want your half.