CVE-2015-3800

Vulnerability

The DiskImages component in Apple iOS prior to version 8.4.1 and OS X prior to version 10.10.5 contains a memory corruption vulnerability that can be triggered by processing a malformed DMG disk image. The issue exists in the code that parses DMG images, and no special configuration is required beyond the ability to mount a DMG file.

Exploitation

An attacker with local access to the system can craft a malicious DMG image and cause the target user or system to mount it. No additional authentication is needed beyond the ability to mount a disk image. The malformed image triggers memory corruption in the DiskImages component, leading to either a denial of service (application crash) or potential privilege escalation.

Impact

Successful exploitation can result in either a denial of service due to application crash or, more critically, privilege escalation, allowing the attacker to gain elevated privileges on the affected system. The exact scope of privilege escalation is not detailed in public sources, but it is considered a serious vulnerability.

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 and OS X Yosemite 10.10.5, released on August 13, 2015 [1][2]. Users should update their devices to these versions or later. No workarounds are available, and the vulnerability is not known to be exploited in the wild as of the publication date.