Alert on MOKB-20-11-2006: Being exploited in the wild?

I've been contacted by a Mac OS X user about a DMG image being distributed as a supposed 'cracked' version of some software, although it contains the 'shareware' (demonstration, time-limited) version available from the vendor website.

Without further investigation, there are no reasons to think it might be the same bug as the one published in MOKB-20-11-2006. A first look over the hexdump of the file shows that it actually contains corrupted data, yet keeping certain sections of the DMG format itself.

There's no security update from Apple right now, thus I would like to strongly recommend a higher level of caution. Don't download DMG files, don't get them off untrusted sources (ex. P2P networks) and disable the Safari feature for opening this kind of files after downloading (via Preferences -> General -> Open 'safe files' after download).

Due to time limitations, research of this issue might overlap with today's release, leading to a short delay.

MOKB-21-11-2006: Mac OS X Apple UDTO HFS+ Disk Image Denial of Service (1)

Mac OS X fails to properly handle corrupted UDTO HFS+ image structures (ex. bad sectors), leading to an exploitable denial of service condition. Although it hasn't been checked further, memory corruption is present under certain conditions (in this particular case, unlikely to allow arbitrary code execution).

• More details and debugging information
• Proof of concept: MOKB-21-11-2006.dmg.bz2 and for Safari users: MOKB-21-11-2006.dmg

MOKB-20-11-2006: Mac OS X Apple UDIF Disk Image Kernel Memory Corruption (1)

Mac OS X com.apple.AppleDiskImageController fails to properly handle corrupted DMG image structures, leading to an exploitable memory corruption condition with potential kernel-mode arbitrary code execution by unprivileged users.

• More details and debugging information
• Proof of concept: MOKB-20-11-2006.dmg.bz2 (needs decompressing), MOKB-20.dmg (direct link for proud Safari users).