|
Mac OS X Updated Version Addresses Thirteen Vulnerabilities
|
|
Secunia Advisory:
|
SA10086
|
|
|
Release Date:
|
2003-10-29
|
|
Last Update:
|
2003-11-20
|
|
Popularity:
|
13,070 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Exposure of sensitive information
Privilege escalation
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Apple Macintosh OS X
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Multiple vulnerabilities have been reported in Mac OS X, where the impact spans from local DoS (Denial of Service) vulnerabilities to privilege escalation, security bypasses and information disclosure.
1) A boundary error in the handling of argv[] arguments can be exploited by malicious, local users to crash the kernel by supplying an overly long command line argument. The vulnerability may possibly also be exploited to escalate privileges, though this hasn't been proven.
The vulnerability could potentially also be exploited remotely if an application spawns a new process based on user input.
Versions 10.2.8 and prior are affected.
2) Due to generally insecure file permissions and an error in handling DMG files, it is possible for malicious, local users to overwrite some executable files. This may be exploited to gain escalated privileges by tricking another user into running an overwritten file.
Versions 10.2.8 and prior are affected.
3) Malicious, local users can overwrite arbitrary files on a system or read core files dumped by privileged processes if core file creation is enabled (disabled by default). This can be exploited via symlink attacks to gain knowledge of sensitive information or corrupt files.
Versions 10.2.8 and prior are affected.
4) The slpd daemon creates temporary files insecurely in the "/tmp" folder when "Personal File Sharing" is enabled (disabled by default). This can be exploited by malicious, local users to overwrite arbitrary files on a system via symlink attacks.
5) An older vulnerability in ktrace can potentially be exploited by malicious, local users to gain knowledge of sensitive information by tracing a specially privileged process.
Successful exploitation requires that the KTRACE kernel option is enabled.
6) An older vulnerability in NFS (Network File System) can be exploited by a malicious user to cause a vulnerable system to lock up by sending specially crafted RPC messages with a zero length payload.
7) An older format string vulnerability in the gm4 utility can potentially be exploited by malicious, local users to escalate privileges.
Successful exploitation requires that a suid program relies on gm4. According to Apple, no privileged applications do this by default.
8) A vulnerability in OpenSSH can be exploited by users to access the system from IPs that they where not supposed to.
For more information:
SA8974
9) An older vulnerability in the nidump utility can be exploited by malicious, local users to read the encrypted passwords in the password file.
10) Due to an error after authenticating with an administrator password, malicious users can access "Preference Panes" that they normally can't access for a short period of time.
11) Since TCP timestamps are initialised with a constant number, malicious people can determine how long a system has been running based on the ID in TCP packets.
12) The Mail application will silently fall back to plain-text authentication when an account is configered to use MD5 Challenge Response but the hashed login fails.
13) It is possible to access Dock functions blindly behind Screen Effects when Full Keyboard Access is enabled.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
13th Nov, 2009
|
New advisories:
|
21 |
|
New vulnerabilities:
|
154 |
|
Updated advisories:
|
29 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
