CVE-2009-1236

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-02 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member.

Affected products

macOS: through 10.5.6; 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 (+49)
Apple Mac Os X Server: through 10.5.6; 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 (+48)

References

http://secunia.com/advisories/34424
http://www.digit-labs.org/files/exploits/xnu-appletalk-zip.c
http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
http://www.securityfocus.com/bid/34201
https://www.exploit-db.com/exploits/8262
http://secunia.com/advisories/34424
http://www.digit-labs.org/files/exploits/xnu-appletalk-zip.c
http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
http://www.securityfocus.com/bid/34201
https://www.exploit-db.com/exploits/8262

Get alerted when CVE-2009-1236 or the next vulnerability affects your stack