PT-2009-2729 · Apple · Dnstools+1

Published 2009-02-13 · Updated 2017-08-08 · CVE-2009-0013

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4.11 through 10.5.6

Description The issue allows local users to gain privileges by listing process information, as dscl in DS Tools requires passwords to be provided as command line arguments.

Recommendations For Apple Mac OS X versions 10.4.11 through 10.5.6, consider restricting access to the dscl command to minimize the risk of exploitation. As a temporary workaround, avoid using the dscl command with password arguments until a fix is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-0013

Affected Products

Dnstools

Macos X

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-0013 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/0422 · Note
• http://securityfocus.com/bid/33815 · Note
• http://support.apple.com/kb/HT3438 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48717 · Note
• http://securityfocus.com/bid/33759 · Note
• http://securitytracker.com/alerts/2009/Feb/1021722.html · Note
• http://secunia.com/advisories/33937 · Note