PT-2007-2204 · Apple · Macos X

Chris Anley · Published 2007-05-24 · Updated 2018-10-16 · CVE-2007-0753

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.3.9 through 10.4.9

Description A format string issue in the VPN daemon allows local users to execute arbitrary code via the -i parameter, specifically the username variable. This could potentially lead to unauthorized access and code execution.

Recommendations For Mac OS X versions 10.3.9 through 10.4.9, avoid using the -i parameter in the VPN daemon until a fix is available. As a temporary workaround, consider restricting access to the VPN daemon to minimize the risk of exploitation.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2007-0753

Affected Products

Macos X

References · 14

• 🔥 https://exploit-db.com/exploits/30096 · Exploit
• 🔥 https://exploit-db.com/exploits/4013 · Exploit
• http://secunia.com/advisories/25402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0753 · Security Note
• http://lists.apple.com/archives/security-announce/2007/May/msg00004.html · Vendor Advisory
• http://vupen.com/english/advisories/2007/1939 · Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=305530 · Note
• http://securityfocus.com/bid/24208 · Note
• http://securityfocus.com/archive/1/469889/100/0/threaded · Note
• http://securityfocus.com/archive/1/469882/100/0/threaded · Note
• http://osvdb.org/35143 · Note
• http://securityfocus.com/bid/24144 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34505 · Note
• http://securitytracker.com/id?1018125 · Note