BID:7628

Apple MacOS X IPSec Policy By Port Bypass Vulnerability

Info

Apple MacOS X IPSec Policy By Port Bypass Vulnerability

Bugtraq ID:	7628
Class:	Input Validation Error
CVE:	CVE-2003-0242
Remote:	Yes
Local:	No
Published:	May 19 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Vulnerability announced by Apple.
Vulnerable:	Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.0 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0

Not Vulnerable:	Apple Mac OS X Server 10.2.6 Apple Mac OS X 10.2.6

Discussion

Apple MacOS X IPSec Policy By Port Bypass Vulnerability

It has been reported that MacOS X does not properly handle some types of traffic when IPSec is enabled, and security policies are implemented by port. This could allow unauthorized users to gain access to potentially sensitive services.

Exploit / POC

Apple MacOS X IPSec Policy By Port Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Apple MacOS X IPSec Policy By Port Bypass Vulnerability

Solution:
Apple has released updated versions of MacOS X to address this issue:

Apple Mac OS X 10.0