PT-2007-2204 · Apple · Macos X

Chris Anley · Publicado 2007-05-24 · Atualizado 2018-10-16 · CVE-2007-0753

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.3.9 through 10.4.9

Description A format string issue in the VPN daemon allows local users to execute arbitrary code via the -i parameter, specifically the username variable. This could potentially lead to unauthorized access and code execution.

Recommendations For Mac OS X versions 10.3.9 through 10.4.9, avoid using the -i parameter in the VPN daemon until a fix is available. As a temporary workaround, consider restricting access to the VPN daemon to minimize the risk of exploitation.

Exploit

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2007-0753

Produtos afetados

Macos X

Referências · 14

• 🔥 https://exploit-db.com/exploits/30096 · Exploit
• 🔥 https://exploit-db.com/exploits/4013 · Exploit
• http://docs.info.apple.com/article.html?artnum=305530 · Nota
• http://secunia.com/advisories/25402 · Aviso do Fabricante
• http://securityfocus.com/bid/24208 · Nota
• http://securityfocus.com/archive/1/469889/100/0/threaded · Nota
• http://securityfocus.com/archive/1/469882/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0753 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2007/May/msg00004.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1939 · Aviso do Fabricante
• http://osvdb.org/35143 · Nota
• http://securityfocus.com/bid/24144 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34505 · Nota
• http://securitytracker.com/id?1018125 · Nota