Sign-up

ID

VAR-200407-0076


CVE

CVE-2004-0430


TITLE

Apple Mac OS X AppleFileServer fails to properly handle certain authentication requests

Trust: 0.8

sources: CERT/CC: VU#648406

DESCRIPTION

Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field. There is a buffer overflow vulnerability in the way Apple's AppleFileServer handles certain authentication requests. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. The issue presents itself when the application receives a 'LoginExt' packet containing a malformed 'PathName' argument. This issue was previously disclosed in a multiple BID 10268 (Apple OS X Multiple Unspecified Large Input Vulnerabilities), however, it is being assigned a new BID as a result of new information available. The problem exists in the pre-authentication stage. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: AppleFileServer Remote Command Execution Release Date: 05/03/2004 Application: AppleFileServer Platform: MacOS X 10.3.3 and below Severity: A remote attacker can execute arbitrary commands as root Authors: Dave G. <daveg@atstake.com> Dino Dai Zovi <ddaizovi@atstake.com> Vendor Status: Informed, Upgrade Available CVE Candidate: CAN-2004-0430 Reference: www.atstake.com/research/advisories/2004/a050304-1.txt Overview: The AppleFileServer provides Apple Filing Protocol (AFP) services for both Mac OS X and Mac OS X server. AFP is a protocol used to remotely mount drives, similar to NFS or SMB/CIFS. AFP is a protocol used to remotely mount drives, similar to NFS or SMB/CIFS. AFP is not enabled by default. It is enabled through the Sharing Preferences section by selecting the 'Personal File Sharing' checkbox. Thereis a pre-authentication remotely exploitable stack buffer overflow that allows an attacker to obtain administrative privileges. The PathName argument is encoded as one-byte specifying the string type, two-bytes specifying the string length, and finally the string itself. A string of type AFPName (0x3) that is longer than the length declared in the packet will overflow the fixed-size stack buffer. The previously described malformed request results in a trivially exploitable stack buffer overflow. Vendor Response: - From APPLE-SA-2004-05-03 Security Update 2004-05-03 AppleFileServer: Fixes CAN-2004-0430 to improve the handling of long passwords. Credit to Dave G. from @stake for reporting this issue. Security Update 2004-05-03 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X 10.3.3 "Panther" ============================= http://download.info.apple.com/Mac_OS_X/061-1213.20040503.vngr3/ 2Z/SecUpd2004-05-03Pan.dmg The download file is named: "SecUpd2004-05-03Pan.dmg" Its SHA-1 digest is: 6f35539668d80ee536305a4146bd982a93706532 For Mac OS X Server 10.3.3 ========================== http://download.info.apple.com/Mac_OS_X/061-1215.20040503.mPp9k/ 2Z/SecUpdSrvr2004-05-03Pan.dmg The download file is named: "SecUpdSrvr2004-05-03Pan.dmg" Its SHA-1 digest is: 3c7da910601fd36d4cdfb276af4783ae311ac5d7 For Mac OS X 10.2.8 "Jaguar" ============================= http://download.info.apple.com/Mac_OS_X/061-1217.20040503.BmkY5/ 2Z/SecUpd2004-05-03Jag.dmg The download file is named: "SecUpd2004-05-03Jag.dmg" Its SHA-1 digest is: 11d5f365e0db58b369d85aa909ac6209e2f49945 For Mac OS X Server 10.2.8 ========================== http://download.info.apple.com/Mac_OS_X/061-1219.20040503.Zsw3S/ 2Z/SecUpdSrvr2004-05-03Jag.dmg The download file is named: "SecUpdSrvr2004-05-03Jag.dmg" Its SHA-1 digest is: 28859a4c88f6e1d1fe253388b233a5732b6e42fb Timeline 3/26/2004 Vendor notified of issue 5/04/2004 Vendor informs us that they have a patch available 4/04/2004 Advisory released Recommendation: If you do not need AFS, disable it. If you do need it, upgrade to the latest version of Panther. Common Vulnerabilities and Exposures (CVE) Information: The Common Vulnerabilities and Exposures (CVE) project has assigned the following names to these issues. These are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. CAN-2004-0430 AppleFileServer Remote Command Execution Open Source Vulnerability Database (OSVDB) Information: More information available at www.osvdb.org OSVDB ID 5762 @stake Vulnerability Reporting Policy: http://www.atstake.com/research/policy/ @stake Advisory Archive: http://www.atstake.com/research/advisories/ PGP Key: http://www.atstake.com/research/pgp_key.asc Copyright 2004 @stake, Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQJbHKUe9kNIfAm4yEQJraQCgvzJSUEBfxJNS5Yrk8tCFoM+7vCsAn0WI aBZDr4XgtWYb05rrBQKn01f2 =A6ex -----END PGP SIGNATURE-----

Trust: 2.79

sources: NVD: CVE-2004-0430 // CERT/CC: VU#648406 // JVNDB: JVNDB-2004-000935 // BID: 10271 // VULHUB: VHN-8860 // PACKETSTORM: 33249

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:lteversion:10.3.3

Trust: 1.0

vendor:apple computermodel: - scope: - version: -

Trust: 0.8

vendor:アップルmodel:apple mac os xscope:lteversion:10.3.3 and earlier

Trust: 0.8

vendor:アップルmodel:apple mac os xscope:lteversion:server 10.3.3 and earlier

Trust: 0.8

vendor:アップルmodel:apple mac os x serverscope:lteversion:10.3.3 and earlier

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:10.3.3

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.3.3

Trust: 0.6

vendor:applemodel:mac os serverscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2

Trust: 0.3

sources: CERT/CC: VU#648406 // BID: 10271 // JVNDB: JVNDB-2004-000935 // CNNVD: CNNVD-200407-024 // NVD: CVE-2004-0430

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-0430
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#648406
value: 27.42

Trust: 0.8

NVD: CVE-2004-0430
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200407-024
value: MEDIUM

Trust: 0.6

VULHUB: VHN-8860
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2004-0430
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-8860
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#648406 // VULHUB: VHN-8860 // JVNDB: JVNDB-2004-000935 // CNNVD: CNNVD-200407-024 // NVD: CVE-2004-0430

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2004-000935 // NVD: CVE-2004-0430

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200407-024

TYPE

Boundary Condition Error

Trust: 0.9

sources: BID: 10271 // CNNVD: CNNVD-200407-024

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-8860

PATCH
title:top pageurl:https://www.apple.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2004-000935

EXTERNAL IDS
db:NVDid:CVE-2004-0430
Trust: 3.7
db:SECTRACKid:1010039
Trust: 3.3
db:SECUNIAid:11539
Trust: 3.3
db:CERT/CCid:VU#648406
Trust: 3.3
db:JVNDBid:JVNDB-2004-000935
Trust: 0.8
db:CNNVDid:CNNVD-200407-024
Trust: 0.7
db:ATSTAKEid:A050304-1
Trust: 0.6
db:XFid:16049
Trust: 0.6
db:APPLEid:APPLE-SA-2004-05-03
Trust: 0.6
db:BIDid:10271
Trust: 0.4
db:PACKETSTORMid:33249
Trust: 0.2
db:SEEBUGid:SSVID-18023
Trust: 0.1
db:SEEBUGid:SSVID-71362
Trust: 0.1
db:SEEBUGid:SSVID-66984
Trust: 0.1
db:SEEBUGid:SSVID-88766
Trust: 0.1
db:SEEBUGid:SSVID-62850
Trust: 0.1
db:PACKETSTORMid:82304
Trust: 0.1
db:PACKETSTORMid:34035
Trust: 0.1
db:EXPLOIT-DBid:391
Trust: 0.1
db:EXPLOIT-DBid:16863
Trust: 0.1
db:EXPLOIT-DBid:9931
Trust: 0.1
db:VULHUBid:VHN-8860
Trust: 0.1
sources:
            
            
            CERT/CC: VU#648406 // 
            
            
            
            VULHUB: VHN-8860 // 
            
            
            
            BID: 10271 // 
            
            
            
            JVNDB: JVNDB-2004-000935 // 
            
            
            
            PACKETSTORM: 33249 // 
            
            
            
            CNNVD: CNNVD-200407-024 // 
            
            
            
            NVD: CVE-2004-0430

REFERENCES
url:http://www.atstake.com/research/advisories/2004/a050304-1.txt
Trust: 3.4
url:http://www.securiteam.com/securitynews/5qp0115cuo.html
Trust: 3.3
url:http://www.kb.cert.org/vuls/id/648406
Trust: 2.5
url:http://securitytracker.com/id?1010039
Trust: 2.5
url:http://secunia.com/advisories/11539
Trust: 2.5
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/16049
Trust: 1.9
url:http://lists.apple.com/mhonarc/security-announce/msg00049.html
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2004-0430
Trust: 0.9
url:http://docs.info.apple.com/article.html?artnum=61798
Trust: 0.8
url:http://secunia.com/advisories/11539/
Trust: 0.8
url:http://www.securitytracker.com/alerts/2004/may/1010039.html2
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/16049
Trust: 0.6
url:http://metasploit.com/projects/framework/exploits.html
Trust: 0.3
url:/archive/1/362117
Trust: 0.3
url:http://cve.mitre.org),
Trust: 0.1
url:http://www.atstake.com/research/advisories/
Trust: 0.1
url:http://download.info.apple.com/mac_os_x/061-1213.20040503.vngr3/
Trust: 0.1
url:http://www.atstake.com/research/pgp_key.asc
Trust: 0.1
url:http://www.atstake.com/research/policy/
Trust: 0.1
url:https://www.osvdb.org
Trust: 0.1
url:http://download.info.apple.com/mac_os_x/061-1219.20040503.zsw3s/
Trust: 0.1
url:http://download.info.apple.com/mac_os_x/061-1215.20040503.mpp9k/
Trust: 0.1
url:http://download.info.apple.com/mac_os_x/061-1217.20040503.bmky5/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#648406 // 
            
            
            
            VULHUB: VHN-8860 // 
            
            
            
            BID: 10271 // 
            
            
            
            JVNDB: JVNDB-2004-000935 // 
            
            
            
            PACKETSTORM: 33249 // 
            
            
            
            CNNVD: CNNVD-200407-024 // 
            
            
            
            NVD: CVE-2004-0430

CREDITS
Dave G※ daveg@atstake.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200407-024

SOURCES
db:CERT/CCid:VU#648406
db:VULHUBid:VHN-8860
db:BIDid:10271
db:JVNDBid:JVNDB-2004-000935
db:PACKETSTORMid:33249
db:CNNVDid:CNNVD-200407-024
db:NVDid:CVE-2004-0430

LAST UPDATE DATE
2024-08-14T12:07:10.910000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#648406date:2004-05-07T00:00:00
db:VULHUBid:VHN-8860date:2017-07-11T00:00:00
db:BIDid:10271date:2009-07-12T04:07:00
db:JVNDBid:JVNDB-2004-000935date:2024-06-07T09:00:00
db:CNNVDid:CNNVD-200407-024date:2005-10-20T00:00:00
db:NVDid:CVE-2004-0430date:2017-07-11T01:30:09.463

SOURCES RELEASE DATE
db:CERT/CCid:VU#648406date:2004-05-07T00:00:00
db:VULHUBid:VHN-8860date:2004-07-07T00:00:00
db:BIDid:10271date:2004-05-03T00:00:00
db:JVNDBid:JVNDB-2004-000935date:2024-06-07T00:00:00
db:PACKETSTORMid:33249date:2004-05-07T16:47:14
db:CNNVDid:CNNVD-200407-024date:2004-05-04T00:00:00
db:NVDid:CVE-2004-0430date:2004-07-07T04:00:00