PT-2008-4269 · Apple · Macos X

Charles Srstka · Published 2008-06-23 · Updated 2017-08-08 · CVE-2008-2830

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.4.11 through 10.5.4 Mac OS X versions prior to 10.4.11 Mac OS X versions prior to 10.5.4

Description The issue concerns the Open Scripting Architecture in Mac OS X, which fails to properly restrict the loading of scripting addition plugins. This allows local users to gain privileges via scripting addition commands to a privileged application. An example of exploitation is through an osascript tell command to ARDAgent.

Recommendations For Mac OS X versions 10.4.11 through 10.5.4, consider restricting access to scripting addition plugins to minimize the risk of exploitation. For Mac OS X versions prior to 10.4.11, update to version 10.4.11 or later to resolve the issue. For Mac OS X versions prior to 10.5.4, update to version 10.5.4 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-2830

Affected Products

Macos X

References · 10

• 🔥 https://exploit-db.com/exploits/31940 · Exploit
• 🔥 http://securityfocus.com/bid/29831 · Exploit
• http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008//Sep/msg00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2830 · Security Note
• http://it.slashdot.org/it/08/06/18/1919224.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43294 · Note
• http://secunia.com/advisories/30776 · Note
• http://vupen.com/english/advisories/2008/1905/references · Note
• http://securitytracker.com/id?1020345 · Note