PT-2008-3814 · Apple+1 · Disk Utility+2

Published 2008-08-04 · Updated 2017-08-08 · CVE-2008-2324

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apple Mac OS X version 10.4.11

Description: The issue concerns the Repair Permissions tool in Disk Utility, which incorrectly sets the setuid bit on the emacs executable file. This allows local users to execute commands within emacs and potentially gain privileges.

Recommendations: For Apple Mac OS X version 10.4.11, remove the setuid bit from the emacs executable file to prevent local users from gaining privileges.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2324

Affected Products

Disk Utility

Macos X

Emacs

References · 8

• http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html · Vendor Advisory
• http://secunia.com/advisories/31326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2324 · Security Note
• http://securitytracker.com/id?1020605 · Note
• http://securityfocus.com/bid/30483 · Note
• http://securityfocus.com/bid/30492 · Note
• http://vupen.com/english/advisories/2008/2268 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44132 · Note