Sign-up

ID

VAR-200506-0225


CVE

CVE-2005-1723


TITLE

Apple Mac OS X Operating system Security Update 2005-006 Multiple vulnerabilities in

Trust: 0.6

sources: CNNVD: CNNVD-200506-052

DESCRIPTION

LaunchServices in Apple Mac OS X 10.4.x up to 10.4.1 does not properly mark file extensions and MIME types as unsafe if an Apple Uniform Type Identifier (UTI) is not created when the type is added to the database of unsafe types, which could allow attackers to bypass intended restrictions. Apple has released Security Update 2005-006 to address multiple local and remote Mac OS X vulnerabilities. The following new vulnerabilities were addressed by the security update: - A buffer overflow (CAN-2005-1721) in the AFP (Apple File Protocol) Server. - A vulnerability (CAN-2005-1720) in AFP Server related to temporary ACLs. - A denial of service vulnerability (CAN-2005-1722) in the CoreGraphics component. - A local privilege escalation (CAN-2005-1726) in the CoreGraphics component. - A local race condition vulnerability (CAN-2005-1727) related to permissions on the system cache and Dashboard folders. - A local privilege escalation vulnerability (CAN-2005-1725) in the launch daemon (launchd). - A vulnerability in Launch Services (CAN-2005-1723) could allow files to bypass "safe download" checks. - A vulnerability (CAN-2005-1728) in the MCX Client that may allow local attackers to gain access to Portable Home Directory credentials. - A vulnerability in NFS (CAN-2005-1724) could allow unauthorized access to exported filesystems. These vulnerabilities will be separated into individual BIDs upon further analysis of the issues. If the ? The MIME type is marked as unsafe

Trust: 1.26

sources: NVD: CVE-2005-1723 // BID: 13899 // VULHUB: VHN-12932

AFFECTED PRODUCTS

vendor:applemodel:mac os x serverscope:eqversion:10.4

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.4.1

Trust: 1.6

vendor:applemodel:mac os serverscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.9

Trust: 0.3

sources: BID: 13899 // CNNVD: CNNVD-200506-052 // NVD: CVE-2005-1723

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-1723
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200506-052
value: HIGH

Trust: 0.6

VULHUB: VHN-12932
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2005-1723
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-12932
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-12932 // CNNVD: CNNVD-200506-052 // NVD: CVE-2005-1723

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-1723

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200506-052

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200506-052

EXTERNAL IDS

db:NVDid:CVE-2005-1723

Trust: 2.0

db:SECTRACKid:1014141

Trust: 1.7

db:CNNVDid:CNNVD-200506-052

Trust: 0.7

db:APPLEid:APPLE-SA-2005-06-08

Trust: 0.6

db:BIDid:13899

Trust: 0.3

db:VULHUBid:VHN-12932

Trust: 0.1

sources: VULHUB: VHN-12932 // BID: 13899 // CNNVD: CNNVD-200506-052 // NVD: CVE-2005-1723

REFERENCES

url:http://lists.apple.com/archives/security-announce/2005/jun/msg00000.html

Trust: 1.7

url:http://securitytracker.com/id?1014141

Trust: 1.7

url:http://www.apple.com/macosx/

Trust: 0.3

url:http://www.info.apple.com/usen/security/security_updates.html

Trust: 0.3

url:http://www.suresec.org/advisories/adv3.pdf

Trust: 0.3

url:http://www.apple.com

Trust: 0.3

url:/archive/1/401822

Trust: 0.3

sources: VULHUB: VHN-12932 // BID: 13899 // CNNVD: CNNVD-200506-052 // NVD: CVE-2005-1723

CREDITS

Discovery of the CoreGraphics issue is credited to Chris Evans. Discovery of the folder permissions issue is credited to Michael Haller. Discovery of the launchd issue is credited to Neil Archibald and Ilja Van Sprundel. Other issues were announced by

Trust: 0.6

sources: CNNVD: CNNVD-200506-052

SOURCES

db:VULHUBid:VHN-12932
db:BIDid:13899
db:CNNVDid:CNNVD-200506-052
db:NVDid:CVE-2005-1723

LAST UPDATE DATE

2024-08-14T13:14:37.051000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-12932date:2008-09-05T00:00:00
db:BIDid:13899date:2009-07-12T14:56:00
db:CNNVDid:CNNVD-200506-052date:2005-10-20T00:00:00
db:NVDid:CVE-2005-1723date:2008-09-05T20:49:54.213

SOURCES RELEASE DATE

db:VULHUBid:VHN-12932date:2005-06-08T00:00:00
db:BIDid:13899date:2005-06-08T00:00:00
db:CNNVDid:CNNVD-200506-052date:2005-06-08T00:00:00
db:NVDid:CVE-2005-1723date:2005-06-08T04:00:00