PT-2010-3451 · Apple · Filing Protocol (Afp) Server+1

Published 2010-09-21 · Updated 2017-09-19 · CVE-2010-1820

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.6.x through 10.6.4

Description The issue is related to the Apple Filing Protocol (AFP) Server, which does not properly handle errors. This allows remote attackers to bypass the password requirement for shared-folder access by leveraging knowledge of a valid account name.

Recommendations For Apple Mac OS X versions 10.6.x through 10.6.4, consider restricting access to shared folders until a fix is available. As a temporary workaround, limit the use of the AFP Server to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-1820

Affected Products

Filing Protocol (Afp) Server

Macos X

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-1820 · Security Note
• http://support.apple.com/kb/HT4361 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010/Sep/msg00004.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12109 · Note
• http://securityfocus.com/bid/43341 · Note