Apple Boot Camp Support Software < 5.1 AppleMNT.sys Driver PE Header Memory Corruption
High Nessus Plugin ID 72602
SynopsisThe remote host has a driver affected by a local memory corruption vulnerability.
DescriptionThe version of Apple Boot Camp Support Software installed on the remote host is a version prior to 5.1. As such, the AppleMNT.sys driver included in it reportedly has a bounds checking issue that can be triggered when parsing a Portable Executable (PE) file with a malformed header. A local attacker may be able to leverage this to corrupt kernel memory resulting in a system crash or arbitrary code execution with elevated privileges.
SolutionUpgrade to Apple Boot Camp Support Software 5.1 or later.