Heap-based buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.

The remote host is affected by the vulnerability described in GLSA-201201-05 (mDNSResponder: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in mDNSResponder. Please       review the CVE identifiers referenced below for details.
  Impact :

    A local or remote attacker may be able to execute arbitrary code with       root privileges or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

ID	Name	Product	Family	Severity
57631	GLSA-201201-05 : mDNSResponder: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2007-3744

high

Tenable Plugins

critical

critical