PT-2005-2693 · Apple · Afp Server

Published 2005-06-14 · Updated 2008-09-05 · CVE-2005-1720

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AFP Server for Mac OS X version 10.4.1

Description The issue arises when using an ACL enabled volume with the AFP Server for Mac OS X. Specifically, it does not properly remove an ACL when a file is copied to a directory that does not use ACLs. This results in the ACL overriding the POSIX file permissions for that ACL.

Recommendations For AFP Server for Mac OS X version 10.4.1, consider disabling ACL support on volumes as a temporary workaround until a patch is available. Restrict access to directories that do not use ACLs to minimize the risk of exploitation. Avoid using ACL enabled volumes for file copying operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1720

Affected Products

Afp Server

References · 2

• http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1720 · Security Note