PT-2007-2180 · Apple · Macos X+1

Published 2007-04-24 · Updated 2011-03-08 · CVE-2007-0729

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.9 through 10.4.9

Description The issue concerns the Apple File Protocol (AFP) Client, which does not properly clean the environment before executing commands. This allows local users to gain privileges by setting unspecified environment variables.

Recommendations For versions 10.3.9 through 10.4.9, consider restricting the execution of commands by the AFP Client until a fix is available, and avoid setting sensitive environment variables that could be exploited.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-0729

Affected Products

Apple File Protocol (Afp) Client

Macos X

References · 10

• http://docs.info.apple.com/article.html?artnum=305391 · Patch
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0729 · Security Note
• http://securitytracker.com/id?1017944 · Note
• http://us-cert.gov/cas/techalerts/TA07-109A.html · Note
• http://osvdb.org/34858 · Note
• http://kb.cert.org/vuls/id/312424 · Note
• http://secunia.com/advisories/24966 · Note
• http://securityfocus.com/bid/23569 · Note
• http://vupen.com/english/advisories/2007/1470 · Note