{"api_version":"1","generated_at":"2026-07-23T08:16:01+00:00","cve":"CVE-2008-4212","urls":{"html":"https://cve.report/CVE-2008-4212","api":"https://cve.report/api/cve/CVE-2008-4212.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4212","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4212"},"summary":{"title":"CVE-2008-4212","description":"Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-10-10 10:30:05","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-16","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://secunia.com/advisories/32222","name":"http://secunia.com/advisories/32222","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2780","name":"http://www.vupen.com/english/advisories/2008/2780","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45785","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45785","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.apple.com/kb/HT3216","name":"http://support.apple.com/kb/HT3216","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Security Update 2008-007","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1021028","name":"http://www.securitytracker.com/id?1021028","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mac OS X rlogin Bug May Let Remote Users Access the System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","name":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"APPLE-SA-2008-10-09 Security Update 2008-007","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/31708","name":"http://www.securityfocus.com/bid/31708","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple Mac OS X 'hosts.equiv' Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/31681","name":"http://www.securityfocus.com/bid/31681","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4212","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4212","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4212","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"10.4.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4212","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"10.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4212","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x_server","cpe6":"10.4.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4212","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x_server","cpe6":"10.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2008-4212","organization":"Red Hat","lastmodified":"2008-10-25","contributor":"Tomas Hoger","statementText":"Not vulnerable. This issue did not affect the versions of rsh-server packages as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5. The glibcs ruserok function is used to check users authorization against rhosts files. That implementation of ruserok never opens /etc/hosts.equiv for superuser.","cve_year":"2008","cve_id":"4212","crc32":"ea3de6f5"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:08:34.972Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"31681","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31681"},{"name":"31708","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31708"},{"name":"1021028","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1021028"},{"name":"32222","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32222"},{"name":"ADV-2008-2780","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"macosx-rlogin-weak-security(45785)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45785"},{"name":"APPLE-SA-2008-10-09","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.apple.com/kb/HT3216"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-10-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"31681","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31681"},{"name":"31708","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31708"},{"name":"1021028","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1021028"},{"name":"32222","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32222"},{"name":"ADV-2008-2780","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"macosx-rlogin-weak-security(45785)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45785"},{"name":"APPLE-SA-2008-10-09","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.apple.com/kb/HT3216"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4212","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"31681","refsource":"BID","url":"http://www.securityfocus.com/bid/31681"},{"name":"31708","refsource":"BID","url":"http://www.securityfocus.com/bid/31708"},{"name":"1021028","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1021028"},{"name":"32222","refsource":"SECUNIA","url":"http://secunia.com/advisories/32222"},{"name":"ADV-2008-2780","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2780"},{"name":"macosx-rlogin-weak-security(45785)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45785"},{"name":"APPLE-SA-2008-10-09","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"name":"http://support.apple.com/kb/HT3216","refsource":"CONFIRM","url":"http://support.apple.com/kb/HT3216"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4212","datePublished":"2008-10-10T10:00:00.000Z","dateReserved":"2008-09-24T00:00:00.000Z","dateUpdated":"2024-08-07T10:08:34.972Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-10-10 10:30:05","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-16","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*","matchCriteriaId":"6EE39585-CF3B-4493-96D8-B394544C7643"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*","matchCriteriaId":"AE1EBF04-C440-4A6B-93F2-DC3A812728C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*","matchCriteriaId":"D09D5933-A7D9-4A61-B863-CD8E7D5E67D8"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*","matchCriteriaId":"C147E866-B80F-4FFA-BBE8-19E84A46DB1C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4212","Ordinal":"1","Title":"CVE-2008-4212","CVE":"CVE-2008-4212","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4212","Ordinal":"1","NoteData":"Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.","Type":"Description","Title":"CVE-2008-4212"},{"CveYear":"2008","CveId":"4212","Ordinal":"2","NoteData":"2008-10-10","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4212","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}