PT-2007-2194 · Apple · Macos X

Published 2007-04-24 · Updated 2011-03-08 · CVE-2007-0743

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.9 through 10.4.9

Description The issue allows local users to potentially obtain sensitive information, such as usernames and passwords, by listing processes. This is due to the URLMount feature passing credentials as command line arguments to the mount sub command.

Recommendations For Apple Mac OS X versions 10.3.9 through 10.4.9, consider restricting access to the mount sub command to minimize the risk of exploitation. As a temporary workaround, avoid using the URLMount feature for mounting filesystems on SMB servers until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-0743

Affected Products

Macos X

References · 9

• http://securityfocus.com/bid/23569 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0743 · Security Note
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA07-109A.html · Note
• http://securitytracker.com/id?1017942 · Note
• http://secunia.com/advisories/24966 · Note
• http://vupen.com/english/advisories/2007/1470 · Note
• http://osvdb.org/34867 · Note
• http://docs.info.apple.com/article.html?artnum=305391 · Note