CVE-2015-3707

Vulnerability

The FireWire driver in IOFireWireFamily in Apple OS X before 10.10.4 contains a NULL pointer dereference vulnerability. A crafted application can trigger this issue, allowing an attacker to execute arbitrary code in a privileged kernel context or cause a denial of service [1]. Affected versions: OS X Yosemite v10.10 through v10.10.3 and OS X Mavericks v10.9.5 [1].

Exploitation

An attacker must have the ability to run a crafted app on the target system. The app interacts with the FireWire driver to trigger a NULL pointer dereference. The attacker needs local access and the ability to execute arbitrary code as a user; no additional privileges or specific hardware are required [1].

Impact

Successful exploitation leads to arbitrary code execution in the kernel context, giving the attacker full system control, or a denial of service due to the NULL pointer dereference. The attacker can gain root privileges and bypass system security mechanisms [1].

Mitigation

The vulnerability is fixed in OS X Yosemite v10.10.4 and Security Update 2015-005, released on June 30, 2015. Users should update via Software Update or the Apple Support downloads. No workaround is available [1].