CVE-2008-1035

Published: Jun 3, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource liberation" bug. NOTE: CVE-2008-2007 was originally used for this issue, but this is the appropriate identifier.

Affected (1)

Products: Apple: Ical

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Ical	Version 3.0.1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (26)

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Source: cve@mitre.org

http://secunia.com/advisories/30430

Source: cve@mitre.org

http://www.coresecurity.com/?action=item&id=2219

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/492414/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/492638/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/492682/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28633

Source: cve@mitre.org

http://www.securityfocus.com/bid/29412

Source: cve@mitre.org

http://www.securityfocus.com/bid/29486

Source: cve@mitre.org

http://www.securitytracker.com/id?1020095

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/1601

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1697

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/30430

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.coresecurity.com/?action=item&id=2219

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securityfocus.com/archive/1/492414/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/492638/100/100/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/492682/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/28633

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29412

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29486

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1020095

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/1601

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/1697

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.