PT-2007-1602 · Apple · Diskutil+2

Published 2007-01-09 · Updated 2011-03-08 · CVE-2007-0117

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DiskManagementTool in DiskManagement.framework version 92.29

Description The issue arises from the improper validation of Bill of Materials (BOM) files by the DiskManagementTool. This allows attackers to gain privileges through a BOM file located under /Library/Receipts/, which can trigger arbitrary file permission changes when a diskutil permission repair operation is executed.

Recommendations For DiskManagementTool in DiskManagement.framework version 92.29, consider restricting access to the /Library/Receipts/ directory to minimize the risk of exploitation until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2007-0117

Affected Products

Diskmanagement.Framework

Diskmanagementtool

Diskutil

References · 8

• 🔥 http://projects.info-pull.com/moab/MOAB-05-01-2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/3088 · Exploit
• 🔥 https://exploit-db.com/exploits/3087 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0117 · Security Note
• http://vupen.com/english/advisories/2007/0074 · Note
• http://osvdb.org/31167 · Note
• http://securityfocus.com/bid/21899 · Note
• http://secunia.com/advisories/23653 · Note