PT-2004-1603 · Apple · Macos X

Kang · Published 2004-05-28 · Updated 2017-07-11 · CVE-2004-0485

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.2.8 through 10.3.3

Description The issue allows remote attackers to write arbitrary files by causing a disk image file (.dmg) to be mounted as a disk volume, due to the default protocol helper for the disk: URI.

Recommendations For Mac OS X versions 10.2.8 through 10.3.3, consider disabling the default protocol helper for the disk: URI as a temporary workaround until a patch is available. Restrict access to mounting disk image files (.dmg) to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0485

Affected Products

Macos X

References · 7

• http://fundisom.com/owned/warning · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0485 · Security Note
• http://kb.cert.org/vuls/id/210606 · Patch
• http://lists.apple.com/mhonarc/security-announce/msg00053.html · Vendor Advisory
• http://lists.seifried.org/pipermail/security/2004-May/003743.html · Vendor Advisory
• http://secunia.com/advisories/11622 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16166 · Note