PT-2007-4987 · Oracle+1 · Java+2

Published 2007-08-03 · Updated 2017-07-29 · CVE-2007-3746

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java interface to CoreAudio on Mac OS X versions 10.3.9 through 10.4.10

Description The issue is related to improper bounds checking of heap read and write operations in the Java interface to CoreAudio. This allows remote attackers to execute arbitrary code via a crafted applet.

Recommendations For Mac OS X versions 10.3.9 through 10.4.10, consider disabling the Java interface to CoreAudio as a temporary workaround until a patch is available. Restrict access to the CoreAudio interface to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3746

Affected Products

Coreaudio

Java

Macos X

References · 8

• http://securitytracker.com/id?1018492 · Patch
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory
• http://securityfocus.com/bid/25159 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3746 · Security Note
• http://secunia.com/advisories/26235 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35727 · Note
• http://vupen.com/english/advisories/2007/2732 · Note
• http://docs.info.apple.com/article.html?artnum=306172 · Note