PT-2017-17544 · Apple · Apple Macos

Felix Schwartz + 1 · Publicado 2017-10-23 · Atualizado 2019-10-03 · CVE-2017-7149

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13 Supplemental Update

Description The issue involves the StorageKit component, allowing attackers to discover passwords for APFS encrypted volumes. This is possible by reading Disk Utility hints, as the stored hint value was accidentally set to the password itself, not the entered hint value.

Recommendations For macOS versions prior to 10.13 Supplemental Update, update to macOS 10.13 Supplemental Update or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Disk Utility hints feature for APFS encrypted volumes until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2017-7149

Produtos afetados

Apple Macos

Referências · 8

• 🔥 https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now · Exploit
• 🔥 https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79 · Exploit
• 🔥 https://theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password · Exploit
• http://securityfocus.com/bid/101178 · Nota
• http://securitytracker.com/id/1039513 · Nota
• https://osv.dev/vulnerability/CVE-2017-7149 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7149 · Nota de Segurança
• https://support.apple.com/HT208165 · Aviso do Fabricante