PT-2005-1229 · Apple · Macos X

Kevin Finisterre · Publicado 2005-01-29 · Atualizado 2018-08-13 · CVE-2005-0125

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.3.7 and earlier

Description The issue concerns the "at" commands, which do not properly drop privileges. This allows local users to delete arbitrary files, execute arbitrary programs, or read arbitrary files. Specifically, the atrm command can be used to delete files, while the batch command with the -f argument can be used to execute programs or read files by generating a readable job file.

Recommendations For Mac OS X versions 10.3.7 and earlier, consider disabling the "at" commands until a patch is available. As a temporary workaround, restrict access to the atrm and batch commands to minimize the risk of exploitation. Avoid using the -f argument with the batch command until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-0125

Produtos afetados

Macos X

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/18981 · Nota
• http://kb.cert.org/vuls/id/678150 · Correção
• http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110685027017411&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0125 · Nota de Segurança
• http://digitalmunition.com/DMA%5B2005-0127a%5D.txt · Nota