PT-2007-4990 · Apple · Macos X

CVE-2007-3749 · Publicado 2007-11-15 · Atualizado 2024-02-09

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4 through 10.4.10

Description The issue allows local users to execute arbitrary code by creating a port before launching a setuid program, then writing to the address space of the setuid process. This is due to the kernel not resetting the current Mach Thread Port or Thread Exception Port when executing a setuid program.

Recommendations For Apple Mac OS X versions 10.4 through 10.4.10, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of setuid programs to minimize the risk of arbitrary code execution.

Correção

Improper Initialization

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2007-3749

Produtos afetados

Macos X

Referências · 10

• http://securityfocus.com/bid/26444 · Nota
• http://us-cert.gov/cas/techalerts/TA07-319A.html · Nota
• http://secunia.com/advisories/27643 · Aviso do Fabricante
• http://docs.info.apple.com/article.html?artnum=307041 · Nota
• https://t.me/cvenotify/70696 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2007-3749 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3868 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=630 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38466 · Nota