PT-2008-4269 · Apple · Macos X

Charles Srstka · Publicado 2008-06-23 · Atualizado 2017-08-08 · CVE-2008-2830

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.4.11 through 10.5.4 Mac OS X versions prior to 10.4.11 Mac OS X versions prior to 10.5.4

Description The issue concerns the Open Scripting Architecture in Mac OS X, which fails to properly restrict the loading of scripting addition plugins. This allows local users to gain privileges via scripting addition commands to a privileged application. An example of exploitation is through an osascript tell command to ARDAgent.

Recommendations For Mac OS X versions 10.4.11 through 10.5.4, consider restricting access to scripting addition plugins to minimize the risk of exploitation. For Mac OS X versions prior to 10.4.11, update to version 10.4.11 or later to resolve the issue. For Mac OS X versions prior to 10.5.4, update to version 10.5.4 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-2830

Produtos afetados

Macos X

Referências · 10

• 🔥 https://exploit-db.com/exploits/31940 · Exploit
• 🔥 http://securityfocus.com/bid/29831 · Exploit
• http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce//2008//Sep/msg00006.html · Aviso do Fabricante
• http://it.slashdot.org/it/08/06/18/1919224.shtml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2830 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43294 · Nota
• http://secunia.com/advisories/30776 · Nota
• http://vupen.com/english/advisories/2008/1905/references · Nota
• http://securitytracker.com/id?1020345 · Nota