Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
BID:33815
Info
Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
| Bugtraq ID: | 33815 |
| Class: | Design Error |
| CVE: |
CVE-2009-0013 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 12 2009 12:00AM |
| Updated: | Feb 18 2009 04:17PM |
| Credit: | Apple |
| Vulnerable: |
Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
The 'dscl' application included with Apple Mac OS X is prone to a local information-disclosure vulnerability that may reveal user passwords to attackers.
A local attacker may exploit this issue to gain information about user passwords. This may aid in further attacks.
This issue affects Mac OS X 10.4.11 and 10.5.6 (both client and server).
NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.
The 'dscl' application included with Apple Mac OS X is prone to a local information-disclosure vulnerability that may reveal user passwords to attackers.
A local attacker may exploit this issue to gain information about user passwords. This may aid in further attacks.
This issue affects Mac OS X 10.4.11 and 10.5.6 (both client and server).
NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.
Exploit / POC
Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
An attacker requires local, interactive access to exploit this issue.
An attacker requires local, interactive access to exploit this issue.
Solution / Fix
Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for more information.
Apple Mac OS X Server 10.4.11
Apple Mac OS X 10.4.11
Apple Mac OS X 10.5.6
Apple Mac OS X Server 10.5.6
Solution:
The vendor has released an advisory and updates. Please see the references for more information.
Apple Mac OS X Server 10.4.11
-
Apple SecUpdSrvr2009-001PPC.dmg
for PPC
http://support.apple.com/downloads/Security_Update_2009_001__Server_Ti ger_PPC_ -
Apple SecUpdSrvr2009-001Univ.dmg
Universal
http://support.apple.com/downloads/Security_Update_2009_001__Server_Un iversal_
Apple Mac OS X 10.4.11
-
Apple SecUpd2009-001Intel.dmg
for Intel
http://support.apple.com/downloads/Security_Update_2009_001__Tiger_Int el_ -
Apple SecUpd2009-001PPC.dmg
for PPC
http://support.apple.com/downloads/Security_Update_2009_001__Tiger_PPC _
Apple Mac OS X 10.5.6
-
Apple SecUpd2009-001.dmg
http://support.apple.com/downloads/Security_Update_2009_001__Leopard_
Apple Mac OS X Server 10.5.6
-
Apple SecUpdSrvr2009-001.dmg
http://support.apple.com/downloads/Security_Update_2009_001__Server_Le opard_
References
Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
References:
References: