Vulnerability Name:

CVE-2009-2804 (CCN-53166)

Assigned:2009-09-11
Published:2009-09-11
Updated:2017-08-17
Summary:Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, and Safari before 4.0.4 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-2804

Source: APPLE
Type: UNKNOWN
APPLE-SA-2009-11-11-1

Source: APPLE
Type: UNKNOWN
APPLE-SA-2009-09-10-2

Source: OSVDB
Type: UNKNOWN
57949

Source: CCN
Type: SA36701
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
36701

Source: CCN
Type: SA37346
Apple Safari Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
37346

Source: CCN
Type: Apple Web site
About Security Update 2009-005

Source: CONFIRM
Type: Vendor Advisory
http://support.apple.com/kb/HT3865

Source: CCN
Type: Apple Safari Web site
About the security content of Safari 4.0.4

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3949

Source: CCN
Type: OSVDB ID: 57949
Apple Mac OS X ColorSync Image Embedded Profile Handling Overflow

Source: BID
Type: UNKNOWN
36357

Source: CCN
Type: BID-36357
Apple Mac OS X ColorSync Heap Based Buffer Overflow Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2009-3217

Source: XF
Type: UNKNOWN
apple-macosx-colosync-bo(53166)

Source: XF
Type: UNKNOWN
apple-macosx-colosync-bo(53166)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:apple:safari:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0:beta:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.0b1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.0b2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3:417.8:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3:417.9:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3:417.9.2:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3:417.9.3:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.3_417.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.4_419.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0_pre:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.0b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.1:beta:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.1b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.3b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4_beta:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.0b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0:beta:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.0b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:*:*:*:*:*:*:*:* (Version <= 4.0.3)
  • AND
  • cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*
  • AND
  • cpe:/a:apple:safari:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4_beta:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.0b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.1b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.3b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.0b:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apple mac os x 10.4.11
    apple mac os x 10.5.8
    apple mac os x server 10.4.11
    apple mac os x server 10.5.8
    apple safari 0.8
    apple safari 0.9
    apple safari 1.0
    apple safari 1.0 beta
    apple safari 1.0 beta2
    apple safari 1.0.0
    apple safari 1.0.0b1
    apple safari 1.0.0b2
    apple safari 1.0.1
    apple safari 1.0.2
    apple safari 1.0.3
    apple safari 1.1.0
    apple safari 1.1.1
    apple safari 1.2
    apple safari 1.2.0
    apple safari 1.2.1
    apple safari 1.2.2
    apple safari 1.2.3
    apple safari 1.2.4
    apple safari 1.2.5
    apple safari 1.3
    apple safari 1.3.0
    apple safari 1.3.1
    apple safari 1.3.2
    apple safari 2
    apple safari 2.0
    apple safari 2.0.0
    apple safari 2.0.1
    apple safari 2.0.2
    apple safari 2.0.3
    apple safari 2.0.3 417.8
    apple safari 2.0.3 417.9
    apple safari 2.0.3 417.9.2
    apple safari 2.0.3 417.9.3
    apple safari 2.0.3_417.9.3
    apple safari 2.0.4
    apple safari 2.0.4_419.3
    apple safari 2.0_pre
    apple safari 3
    apple safari 3.0
    apple safari 3.0.0
    apple safari 3.0.0b
    apple safari 3.0.1
    apple safari 3.0.1 beta
    apple safari 3.0.1b
    apple safari 3.0.2
    apple safari 3.0.2b
    apple safari 3.0.3
    apple safari 3.0.3b
    apple safari 3.0.4
    apple safari 3.0.4_beta
    apple safari 3.0.4b
    apple safari 3.1
    apple safari 3.1.0
    apple safari 3.1.0b
    apple safari 3.1.1
    apple safari 3.1.2
    apple safari 3.2
    apple safari 3.2.0
    apple safari 3.2.1
    apple safari 3.2.2
    apple safari 3.2.3
    apple safari 4.0
    apple safari 4.0 beta
    apple safari 4.0.0b
    apple safari 4.0.1
    apple safari 4.0.2
    apple safari *
    microsoft windows *
    apple mac os x 10.4.11
    apple mac os x server 10.4.11
    apple mac os x 10.5.8
    apple mac os x server 10.5.8
    apple safari 3.0.1
    apple safari 3.0.2
    apple safari 3.0.3
    apple safari 3.0.4_beta
    apple safari 3.1
    apple safari 3.0
    apple safari 3.0.4
    apple safari 3.1.1
    apple safari 3.1.2
    apple safari 3.2
    apple safari 3.2.1
    apple safari 3.2.2
    apple safari 3.0.0b
    apple safari 3.0.1b
    apple safari 3.0.2b
    apple safari 3.0.3b
    apple safari 3.1.0
    apple safari 3.1.0b
    apple safari 3.2.3
    apple safari 4.0
    apple safari 4.0.1
    apple safari 4.0.2
    apple safari 4.0.3