Sign-up

ID

VAR-200506-0229


CVE

CVE-2005-1728


TITLE

Apple Mac OS X MCX Client security vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200506-057

DESCRIPTION

MCX Client for Apple Mac OS X 10.4.x up to 10.4.1 insecurely logs Portable Home Directory credentials, which allows local users to obtain the credentials. The following new vulnerabilities were addressed by the security update: - A buffer overflow (CAN-2005-1721) in the AFP (Apple File Protocol) Server. - A vulnerability (CAN-2005-1720) in AFP Server related to temporary ACLs. - A denial of service vulnerability (CAN-2005-1722) in the CoreGraphics component. - A local privilege escalation (CAN-2005-1726) in the CoreGraphics component. - A local race condition vulnerability (CAN-2005-1727) related to permissions on the system cache and Dashboard folders. - A local privilege escalation vulnerability (CAN-2005-1725) in the launch daemon (launchd). - A vulnerability in Launch Services (CAN-2005-1723) could allow files to bypass "safe download" checks. - A vulnerability in NFS (CAN-2005-1724) could allow unauthorized access to exported filesystems. These vulnerabilities will be separated into individual BIDs upon further analysis of the issues

Trust: 1.26

sources: NVD: CVE-2005-1728 // BID: 13899 // VULHUB: VHN-12937

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.4.1

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4

Trust: 1.6

vendor:applemodel:mac os serverscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.9

Trust: 0.3

sources: BID: 13899 // CNNVD: CNNVD-200506-057 // NVD: CVE-2005-1728

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2005-1728
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200506-057
value: MEDIUM

Trust: 0.6

VULHUB: VHN-12937
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2005-1728
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-12937
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-12937 // CNNVD: CNNVD-200506-057 // NVD: CVE-2005-1728

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-1728

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-200506-057

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200506-057

EXTERNAL IDS

db:NVDid:CVE-2005-1728

Trust: 2.0

db:SECTRACKid:1014148

Trust: 1.7

db:CNNVDid:CNNVD-200506-057

Trust: 0.7

db:APPLEid:APPLE-SA-2005-06-08

Trust: 0.6

db:BIDid:13899

Trust: 0.3

db:VULHUBid:VHN-12937

Trust: 0.1

sources: VULHUB: VHN-12937 // BID: 13899 // CNNVD: CNNVD-200506-057 // NVD: CVE-2005-1728

REFERENCES

url:http://lists.apple.com/archives/security-announce/2005/jun/msg00000.html

Trust: 1.7

url:http://securitytracker.com/id?1014148

Trust: 1.7

url:http://www.apple.com/macosx/

Trust: 0.3

url:http://www.info.apple.com/usen/security/security_updates.html

Trust: 0.3

url:http://www.suresec.org/advisories/adv3.pdf

Trust: 0.3

url:http://www.apple.com

Trust: 0.3

url:/archive/1/401822

Trust: 0.3

sources: VULHUB: VHN-12937 // BID: 13899 // CNNVD: CNNVD-200506-057 // NVD: CVE-2005-1728

CREDITS

Discovery of the CoreGraphics issue is credited to Chris Evans. Discovery of the folder permissions issue is credited to Michael Haller. Discovery of the launchd issue is credited to Neil Archibald and Ilja Van Sprundel. Other issues were announced by

Trust: 0.6

sources: CNNVD: CNNVD-200506-057

SOURCES

db:VULHUBid:VHN-12937
db:BIDid:13899
db:CNNVDid:CNNVD-200506-057
db:NVDid:CVE-2005-1728

LAST UPDATE DATE

2024-08-14T12:43:34.552000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-12937date:2008-09-05T00:00:00
db:BIDid:13899date:2009-07-12T14:56:00
db:CNNVDid:CNNVD-200506-057date:2005-10-20T00:00:00
db:NVDid:CVE-2005-1728date:2008-09-05T20:49:54.980

SOURCES RELEASE DATE

db:VULHUBid:VHN-12937date:2005-06-08T00:00:00
db:BIDid:13899date:2005-06-08T00:00:00
db:CNNVDid:CNNVD-200506-057date:2005-06-08T00:00:00
db:NVDid:CVE-2005-1728date:2005-06-08T04:00:00