PT-2005-2334 · Apple · Applescript Editor+1

David Remahl · Publicado 2005-05-04 · Atualizado 2011-03-08 · CVE-2005-1331

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mac OS X version 10.3.9

Description: The issue concerns the AppleScript Editor in Mac OS X, which fails to properly display script code for an applescript: URI. This can lead to a discrepancy between the displayed code and the actual code that would be executed, potentially allowing remote attackers to deceive users into running malicious code. This can be achieved through the use of certain URI characters, including NULL, control characters, and homographs.

Recommendations: For Mac OS X version 10.3.9, consider avoiding the use of the AppleScript Editor for executing scripts from untrusted sources until a fix is available. As a temporary workaround, restrict the handling of applescript: URIs to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-1331

Produtos afetados

Applescript Editor

Macos X

Referências · 6

• 🔥 http://remahl.se/david/vuln/010 · Exploit
• http://secunia.com/advisories/15227 · Correção
• http://securityfocus.com/bid/13480 · Correção
• http://lists.apple.com/archives/security-announce/2005/May/msg00001.html · Correção, Aviso do Fabricante
• http://vupen.com/english/advisories/2005/0455 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1331 · Nota de Segurança