PT-2007-2194 · Apple · Macos X

Publicado 2007-04-24 · Atualizado 2011-03-08 · CVE-2007-0743

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.9 through 10.4.9

Description The issue allows local users to potentially obtain sensitive information, such as usernames and passwords, by listing processes. This is due to the URLMount feature passing credentials as command line arguments to the mount sub command.

Recommendations For Apple Mac OS X versions 10.3.9 through 10.4.9, consider restricting access to the mount sub command to minimize the risk of exploitation. As a temporary workaround, avoid using the URLMount feature for mounting filesystems on SMB servers until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-0743

Produtos afetados

Macos X

Referências · 9

• http://us-cert.gov/cas/techalerts/TA07-109A.html · Nota
• http://securityfocus.com/bid/23569 · Correção
• http://securitytracker.com/id?1017942 · Nota
• http://secunia.com/advisories/24966 · Nota
• http://vupen.com/english/advisories/2007/1470 · Nota
• http://osvdb.org/34867 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0743 · Nota de Segurança
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Aviso do Fabricante
• http://docs.info.apple.com/article.html?artnum=305391 · Nota