Apple Mac OS X AFP Information Disclosure Vulnerability

Bugtraq ID:	18733
Class:	Access Validation Error
CVE:	CVE-2006-1468
Remote:	No
Local:	Yes
Published:	Jun 27 2006 12:00AM
Updated:	Jun 29 2006 11:09PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4
Not Vulnerable:	Apple Mac OS X Server 10.4.7 Apple Mac OS X 10.4.7

Apple Mac OS X AFP Information Disclosure Vulnerability

Mac OS X is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly secure potentially sensitive information.

An attacker can exploit this issue to retrieve potentially sensitive information that may aid in further attacks.

This issue was initially discussed in BID 18686 (Apple Mac OS X Multiple Security Vulnerabilities), which has been split into individual BIDs to discuss each issue separately.

Apple Mac OS X AFP Information Disclosure Vulnerability

An attacker can use the search function to exploit this issue.

Apple Mac OS X AFP Information Disclosure Vulnerability

Solution:
The vendor has released OS X version 10.4.7 to address this issue.


Apple Mac OS X Server 10.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.1

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.1

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.2

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.2

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.3

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.3

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.4

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.5

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.5

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.6

• Apple MacOSXServerUpdate10.4.7.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.6

• Apple MacOSXUpd10.4.7Intel.dmg
  for Intel
  http://www.apple.com/support/downloads/


• Apple MacOSXUpd10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X AFP Information Disclosure Vulnerability

References:

• Apple Downloads (Apple)
  
• Apple Security Updates (Apple)
  
• Mac OS X Homepage (Apple)