Apple Mac OS X 10.5 Application Firewall Misleading Configuration Weakness

Bugtraq ID:	26461
Class:	Design Error
CVE:	CVE-2007-4702
Remote:	Yes
Local:	No
Published:	Nov 15 2007 12:00AM
Updated:	Nov 15 2007 11:14PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Apple Mac OS X Server 10.5 Apple Mac OS X 10.5
Not Vulnerable:	Apple Mac OS X Server 10.5.1 Apple Mac OS X 10.5.1

Apple Mac OS X 10.5 Application Firewall Misleading Configuration Weakness

Apple Mac OS X 10.5's Application Firewall is prone to a misleading configuration weakness because of a flaw in the application's configuration dialog and documentation.

This issue may lead to a false sense of security, potentially aiding in network-based attacks.

Apple Mac OS X 10.5 is vulnerable to this issue.

Apple Mac OS X 10.5 Application Firewall Misleading Configuration Weakness

Exploiting this issue does not require specific exploit code, but any vulnerabilities that this issue exposes may require exploit code.

Apple Mac OS X 10.5 Application Firewall Misleading Configuration Weakness

Solution:
Apple has released an advisory along with fixes to address this issue. Please see the references for more information.


Apple Mac OS X 10.5

• Apple Mac OS X 10.5.1 Update
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16133&cat= 60&platform=osx&method=sa/MacOSXUpd10.5.1.dmg

Apple Mac OS X Server 10.5

• Apple Mac OS X Server 10.5.1 Update
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16134&cat= 60&platform=osx&method=sa/MacOSXServerUpd10.5.1.dmg

Apple Mac OS X 10.5 Application Firewall Misleading Configuration Weakness

References:

• About the security content of the Mac OS X 10.5.1 Update (client and server) (Apple)
  
• Mac OS X Homepage (Apple)