Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
BID:3325
Info
Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
| Bugtraq ID: | 3325 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 11 2001 12:00AM |
| Updated: | Sep 11 2001 12:00AM |
| Credit: | Reported to bugtraq by Eric Bennett <[email protected]> on September 10, 2001. |
| Vulnerable: |
Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 |
| Not Vulnerable: |
Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 |
Discussion
Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
A vulnerability has been found in default configurations of Macintosh OS X.
A remote attacker may read the indexed contents of files by submitting a URL to the vulnerable host's web service of the following form:
http://www.example.com/target_directory/.FBCIndex.
This information could provide an attacker with sensitive information including potential passwords useful in dictionary attacks, system configuration, installed applications, etc. Properly exploited, this information could allow an attacker to further compromise the security of the host.
A vulnerability has been found in default configurations of Macintosh OS X.
A remote attacker may read the indexed contents of files by submitting a URL to the vulnerable host's web service of the following form:
http://www.example.com/target_directory/.FBCIndex.
This information could provide an attacker with sensitive information including potential passwords useful in dictionary attacks, system configuration, installed applications, etc. Properly exploited, this information could allow an attacker to further compromise the security of the host.
Exploit / POC
Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
See discussion.
See discussion.
Solution / Fix
Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
Solution:
It is reported that this issue is addressed in the Apple Mac OS X and Mac OS X Server release versions 10.2 and above. This is not confirmed.
Solution:
It is reported that this issue is addressed in the Apple Mac OS X and Mac OS X Server release versions 10.2 and above. This is not confirmed.
References
Apple Macintosh OS X FBCIndex File Contents Disclosure Vulnerability
References:
References: