Apple Mac OS X MobileMe Email Aliases Information Disclosure Vulnerability

Bugtraq ID:	48444
Class:	Unknown
CVE:	CVE-2011-0207
Remote:	Yes
Local:	No
Published:	Jun 23 2011 12:00AM
Updated:	Jun 23 2011 12:00AM
Credit:	Aaron Sigel of vtty.com
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6.7 Apple Mac OS X 10.6
Not Vulnerable:	Apple Mac OS X Server 10.6.8 Apple Mac OS X 10.6.8

Apple Mac OS X MobileMe Email Aliases Information Disclosure Vulnerability

Apple Mac OS X is prone to an information-disclosure vulnerability in MobileMe.

A man-in-the-middle attacker may be able to exploit this issue to retrieve MobileMe email aliases. Information obtained may aid in further attacks.

NOTE: This issue was previously discussed in BID 48412 (Apple Mac OS X Prior to 10.6.8 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Mac OS X MobileMe Email Aliases Information Disclosure Vulnerability

An attacker can exploit this issue through man-in-the-middle attacks to intercept traffic.

Apple Mac OS X MobileMe Email Aliases Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Apple Mac OS X 10.6.7

• Apple MacOSXUpd10.6.8.dmg
  For Mac OS X v10.6.7
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.7

• Apple MacOSXServerUpd10.6.8.dmg
  For Mac OS X Server v10.6.7
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.2

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.5

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.5

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.6

• Apple MacOSXUpdCombo10.6.8.dmg
  For Mac OS X v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X MobileMe Email Aliases Information Disclosure Vulnerability

References:

• Mac OS X Homepage (Apple)