PT-2010-3078 · Apple · Macos X

Published 2010-06-17 · Updated 2010-06-18 · CVE-2010-1381

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.5.8, and 10.6 through 10.6.3

Description The default configuration of SMB File Server in the affected versions enables support for wide links. This allows remote authenticated users to access arbitrary files via vectors involving symbolic links.

Recommendations For Apple Mac OS X version 10.5.8, consider disabling the SMB File Server until a patch is available. For Apple Mac OS X versions 10.6 through 10.6.3, update to version 10.6.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2010-1381

Affected Products

Macos X

References · 7

• http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html · Vendor Advisory
• http://support.apple.com/kb/HT4188 · Vendor Advisory
• http://securityfocus.com/bid/40871 · Patch
• http://secunia.com/advisories/40220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1381 · Security Note
• http://vupen.com/english/advisories/2010/1481 · Vendor Advisory
• http://securitytracker.com/id?1024103 · Note