Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.

This update of usbmuxd fixes a heap-based buffer overflow which could be triggered via an overly long 'SerialNumber' field (CVE-2012-0065).

usbmuxd was prone to a buffer overflow vulnerability

Updated usbmuxd packages fix security vulnerability :

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user (CVE-2012-0065).

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user (CVE-2012-0065).

The updated packages have been patched to correct this issue.

This update of usbmuxd fixes a heap-based buffer overflow which could be triggered via an overly long 'SerialNumber' field. (CVE-2012-0065)

The remote host is affected by the vulnerability described in GLSA-201203-11 (usbmuxd: User-assisted execution of arbitrary code)

    The 'receive_packet()' function in libusbmuxd.c contains a boundary       error when parsing the 'SerialNumber' field of a USB device, which could       cause a heap-based buffer overflow.
  Impact :

    An attacker could gain physical access or entice a user to connect to a       malicious USB device, possibly resulting in execution of arbitrary code       with the privileges of the 'usbmux' user.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2012-0065

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75867	openSUSE Security Update : iproxy (openSUSE-SU-2012:0345-1)	Nessus	SuSE Local Security Checks	medium
74561	openSUSE Security Update : usbmuxd (openSUSE-2012-140)	Nessus	SuSE Local Security Checks	medium
66145	Mandriva Linux Security Advisory : usbmuxd (MDVSA-2013:133)	Nessus	Mandriva Local Security Checks	medium
61981	Mandriva Linux Security Advisory : usbmuxd (MDVSA-2012:133)	Nessus	Mandriva Local Security Checks	medium
58317	SuSE 11.2 Security Update : usbmuxd (SAT Patch Number 5871)	Nessus	SuSE Local Security Checks	medium
58221	GLSA-201203-11 : usbmuxd: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
58014	Fedora 15 : usbmuxd-1.0.7-3.fc15 (2012-1213)	Nessus	Fedora Local Security Checks	medium
58013	Fedora 16 : usbmuxd-1.0.7-3.fc16 (2012-1192)	Nessus	Fedora Local Security Checks	medium
57790	Ubuntu 11.04 / 11.10 : usbmuxd vulnerability (USN-1354-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-0065

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium