Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
BID:33820
Info
Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
| Bugtraq ID: | 33820 |
| Class: | Design Error |
| CVE: |
CVE-2009-0014 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 12 2009 12:00AM |
| Updated: | Feb 18 2009 03:57PM |
| Credit: | Graham Perrin of CENTRIM, University of Brighton |
| Vulnerable: |
Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
Apple Mac OS X is prone to a local information-disclosure vulnerability.
A local attacker may exploit this issue to gain access to the Downloads folders of other users and potentially obtain sensitive information. This may aid in further attacks.
This issue affects Mac OS X v10.5.6 and Mac OS X Server v10.5.6.
NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.
Apple Mac OS X is prone to a local information-disclosure vulnerability.
A local attacker may exploit this issue to gain access to the Downloads folders of other users and potentially obtain sensitive information. This may aid in further attacks.
This issue affects Mac OS X v10.5.6 and Mac OS X Server v10.5.6.
NOTE: This issue was previously covered in BID 33759 (Apple Mac OS X 2009-001 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.
Exploit / POC
Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
An attacker uses standard commands to exploit this issue.
An attacker uses standard commands to exploit this issue.
Solution / Fix
Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.
Apple Mac OS X Server 10.5.6
Apple Mac OS X 10.5.6
Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.
Apple Mac OS X Server 10.5.6
-
Apple SecUpdSrvr2009-001.dmg
http://support.apple.com/downloads/Security_Update_2009_001__Server_Le opard_
Apple Mac OS X 10.5.6
-
Apple SecUpd2009-001.dmg
http://support.apple.com/downloads/Security_Update_2009_001__Leopard_
References
Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
References:
References: