CVE-2015-1144

Vulnerability

A buffer overflow vulnerability exists in the UniformTypeIdentifiers component of Apple OS X versions prior to 10.10.3. The issue is triggered when processing a crafted Uniform Type Identifier (UTI) string. This memory corruption can be exploited locally by an attacker who can supply a malicious UTI to the system.

Exploitation

An attacker with local access to the system can exploit this vulnerability by crafting a malicious Uniform Type Identifier and causing the UniformTypeIdentifiers component to process it. No user interaction beyond local access is required; the attacker only needs to be able to trigger the parsing of the crafted UTI, potentially through a custom application or command-line invocation.

Impact

Successful exploitation allows a local attacker to gain elevated privileges on the system. The buffer overflow can be used to execute arbitrary code in the context of a system process, leading to full system compromise.

Mitigation

The vulnerability is addressed in OS X Yosemite v10.10.3, released on April 8, 2015. Users should update to this version or later via the Mac App Store or Software Update. No workarounds are available for affected versions [1].