ftpd on Mac OS X 10.8.3 suffers from a denial of service vulnerability. This appears to be an old vulnerability that has not been properly addressed.
13b77811aa62fba78277a75249e3609cc4a3861977ccbcd966b983a25d221503
MacOSX 10.8.3 ftpd Remote Resource Exhaustion
Maksymilian Arciemowicz
https://cxsecurity.com/
https://cvemap.org/
Public Date: 01.02.2013
https://cxsecurity.com/cveshow/CVE-2010-2632
https://cxsecurity.com/cveshow/CVE-2011-0418
--- 1. Description ---
Old vulnerability in libc allow to denial of service ftpd in MacOSX 10.8.3. Officially Apple has resolved this issue in Jun 2011. Apple use tnftpd as a main ftp server. tnftpd has migrated some functions from libc to own code (including glob(3)). Missing patch for resource exhaustion was added in version 20130322.
To this time, we can use CVE-2010-2632 to denial of service the ftp server. The funniest is report
https://support.apple.com/kb/ht4723
where CVE-2010-2632 was patched. That true 'libc is patched', but nobody from Apple has verified ftp. I really don't believe in penetrating testing form Apple side. Situation don't seems good. I has asked for open source donations, unfortunately Apple do not financial help vendors, what use their software in own products.
Proof of Concept is available since 2010
https://cxsecurity.com/issue/WLB-2011030145
Video demonstrated how to kill Mac Mini in basic version i5 with 10GB RAM in 30 min is available on
https://cxsec.org/video/macosx_ftpd_poc/
--- 2. References ---
Multiple Vendors libc/glob(3) remote ftpd resource exhaustion
https://cxsecurity.com/issue/WLB-2010100135
https://cxsecurity.com/cveshow/CVE-2010-2632
Multiple FTPD Server GLOB_BRACE|GLOB_LIMIT memory exhaustion
https://cxsecurity.com/issue/WLB-2011050004
https://cxsecurity.com/cveshow/CVE-2011-0418
More CWE-399 resource exhaustion examples:
https://cxsecurity.com/cwe/CWE-399
Last related to
https://www.freebsd.org/security/advisories/FreeBSD-SA-13:02.libc.asc
--- 3. Contact ---
Maksymilian Arciemowicz
Best regards,
CXSEC TEAM
https://cxsecurity.com/