Sign-up

ID

VAR-201409-0465


CVE

CVE-2014-4424


TITLE

Apple OS X Server of CoreCollaboration of Wiki Server In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-004306

DESCRIPTION

SQL injection vulnerability in Wiki Server in CoreCollaboration in Apple OS X Server before 2.2.3 and 3.x before 3.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. The software enables file sharing, meeting scheduling, website hosting, network remote access, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-3 OS X Server v4.0 OS X Server v4.0 is now available and addresses the following: BIND Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in BIND, the most serious of which may lead to a denial of service Description: Multiple vulnerabilities existed in BIND. This issue was addressed through additional validation of SQL queries. CVE-ID CVE-2014-4424 : Sajjad Pourali (sajjad@securation.com) of CERT of Ferdowsi University of Mashhad CoreCollaboration Available for: OS X Yosemite v10.10 or later Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: A cross-site scripting issue existed in Xcode Server. This issue was addressed through improved encoding of HTML output. CVE-ID CVE-2014-4406 : David Hoyt of Hoyt LLC CoreCollaboration Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in PostgreSQL, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in PostgreSQL. These issues were addressed by updating PostgreSQL to version 9.2.7. CVE-ID CVE-2014-0060 CVE-2014-0061 CVE-2014-0062 CVE-2014-0063 CVE-2014-0064 CVE-2014-0065 CVE-2014-0066 Mail Service Available for: OS X Yosemite v10.10 or later Impact: Group SACL changes for Mail may not be respected until after a restart of the Mail service Description: SACL settings for Mail were cached and changes to the SACLs were not respected until after a restart of the Mail service. This issue was addressed by resetting the cache upon changes to the SACLs. CVE-ID CVE-2014-4446 : Craig Courtney Profile Manager Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in LibYAML, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in LibYAML. These issues were addressed by switching from YAML to JSON as Profile Manager's internal serialization format. CVE-ID CVE-2013-4164 CVE-2013-6393 Profile Manager Available for: OS X Yosemite v10.10 or later Impact: A local user may obtain passwords after setting up or editing profiles in Profile Manager Description: In certain circumstances, setting up or editing profiles in Profile Manager may have logged passwords to a file. This issue was addressed through improved handling of credentials. CVE-ID CVE-2014-4447 : Mayo Jordanov Server Available for: OS X Yosemite v10.10 or later Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling SSL 3.0 support in Web Server, Calendar & Contacts Server, and Remote Administration. CVE-ID CVE-2014-3566 : Bodo Moeller, Thai Duong, and Krzysztof Kotowicz of Google Security Team ServerRuby Available for: OS X Yosemite v10.10 or later Impact: Running a Ruby script that handles untrusted YAML tags may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in LibYAML's handling of YAML tags. This issue was addressed through additional validation of YAML tags. This issue does not affect systems prior to OS X Mavericks. CVE-ID CVE-2013-6393 OS X Server v4.0 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUQCLKAAoJEBcWfLTuOo7tqr0P/1fGVeD8xAAgMRpH/hYYkKpj CGKAUBfTXM9clAhUHP1Es+T1qG67JX9CNrrl5yKMQCupojgNIkO1D0Pj5QlLZzkL HR6AgI8eYeykiw8VRFI8DC7f3q/A1aRrijj8bPQ6BoPUq28Vya/GjEAMxV1l21l1 qLyNiDH8X8DC/CWyxOXVMD4yqIpzCOPEIAvgV1aB0z1UEdw7fLLBCEIAkNR3tL9M 5OlRT8X4dzpx3YpTvlB9s7zIAPtLgTjcVpPbkT2yJ9OZsewml2aFM7NWDYpYhIRg z7bOMmKZep15a+XeXH7cdqXMfHW/XGdkYF/4Z85wHG44Kebaikq+K0XoTxjHlqXi 9rtNdcwh+p4DxTQNO0fK7WbfAo7FiF6aonY9D9hp47jbhB9KODVeOpqo6B7sOudq tBAAS1pBbrsULUWRCZRaN3LlPigtInqIIPuLGVQx4ApUo1guxXb0A88ZU3yiR+Bl RJHAEoevKjqhLiZDt1V8sSk6sPAh7p02deP5RDIwNJfapP+RrXoJ6knexRD44kNb MwVD6a2EcOoRFgwcjvgFZ1etpoHT/VAs7Ql/GjWN5snDLsZ/vlGtSPn1i3kjkxBZ oYDmJfC91RoC6exW7img3H9csN0sgtVGJRLrf6cdg41EjVjQaUUVQfBn/DVVyMb8 fIWnhQEvESJVqfrk3Q3X =LbVb -----END PGP SIGNATURE-----

Trust: 2.25

sources: NVD: CVE-2014-4424 // JVNDB: JVNDB-2014-004306 // BID: 69918 // VULHUB: VHN-72364 // PACKETSTORM: 128318 // PACKETSTORM: 128317 // PACKETSTORM: 128731

AFFECTED PRODUCTS

vendor:applemodel:os x serverscope:eqversion:2.0

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:3.0.2

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:2.1.1

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:2.2.1

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:3.1.2

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:2.2

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:3.0.1

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:2.1

Trust: 1.6

vendor:applemodel:os x serverscope:eqversion:3.0

Trust: 1.6

vendor:applemodel:os x serverscope:lteversion:2.2.2

Trust: 1.0

vendor:applemodel:os x serverscope:eqversion:3.0.3

Trust: 1.0

vendor:applemodel:os x serverscope:eqversion:3.1.1

Trust: 1.0

vendor:applemodel:os x serverscope:eqversion:3.1

Trust: 1.0

vendor:applemodel:macos serverscope:ltversion:2.2.3 (os x mountain lion v10.8.5)

Trust: 0.8

vendor:applemodel:macos serverscope:ltversion:3.2.1 (os x mavericks v10.9.5 or later )

Trust: 0.8

vendor:applemodel:macos serverscope:ltversion:4.0 (os x yosemite v10.10 or later )

Trust: 0.8

vendor:applemodel:os x serverscope:eqversion:2.2.2

Trust: 0.6

sources: JVNDB: JVNDB-2014-004306 // CNNVD: CNNVD-201409-716 // NVD: CVE-2014-4424

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4424
value: HIGH

Trust: 1.0

NVD: CVE-2014-4424
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201409-716
value: HIGH

Trust: 0.6

VULHUB: VHN-72364
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-4424
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-72364
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-72364 // JVNDB: JVNDB-2014-004306 // CNNVD: CNNVD-201409-716 // NVD: CVE-2014-4424

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-72364 // JVNDB: JVNDB-2014-004306 // NVD: CVE-2014-4424

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201409-716

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201409-716

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-004306

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-72364

PATCH
title:HT6449url:http://support.apple.com/kb/HT6449
Trust: 0.8
title:HT6536url:http://support.apple.com/kb/HT6536
Trust: 0.8
title:HT6448url:http://support.apple.com/kb/HT6448
Trust: 0.8
title:HT6448url:http://support.apple.com/kb/HT6448?viewlocale=ja_JP
Trust: 0.8
title:HT6449url:http://support.apple.com/kb/HT6449?viewlocale=ja_JP
Trust: 0.8
title:HT6536url:http://support.apple.com/kb/HT6536?viewlocale=ja_JP
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-004306

EXTERNAL IDS
db:NVDid:CVE-2014-4424
Trust: 3.1
db:BIDid:69918
Trust: 1.4
db:SECUNIAid:61305
Trust: 1.1
db:SECUNIAid:61307
Trust: 1.1
db:SECTRACKid:1030869
Trust: 1.1
db:JVNid:JVNVU93868849
Trust: 0.8
db:JVNid:JVNVU97537282
Trust: 0.8
db:JVNDBid:JVNDB-2014-004306
Trust: 0.8
db:CNNVDid:CNNVD-201409-716
Trust: 0.7
db:PACKETSTORMid:128318
Trust: 0.2
db:VULHUBid:VHN-72364
Trust: 0.1
db:PACKETSTORMid:128317
Trust: 0.1
db:PACKETSTORMid:128731
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72364 // 
            
            
            
            BID: 69918 // 
            
            
            
            JVNDB: JVNDB-2014-004306 // 
            
            
            
            PACKETSTORM: 128318 // 
            
            
            
            PACKETSTORM: 128317 // 
            
            
            
            PACKETSTORM: 128731 // 
            
            
            
            CNNVD: CNNVD-201409-716 // 
            
            
            
            NVD: CVE-2014-4424

REFERENCES
url:http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
Trust: 1.9
url:http://support.apple.com/kb/ht6448
Trust: 1.7
url:http://support.apple.com/kb/ht6449
Trust: 1.7
url:http://www.securityfocus.com/bid/69918
Trust: 1.1
url:https://support.apple.com/kb/ht6536
Trust: 1.1
url:http://www.securitytracker.com/id/1030869
Trust: 1.1
url:http://secunia.com/advisories/61305
Trust: 1.1
url:http://secunia.com/advisories/61307
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/96048
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4424
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97537282/index.html
Trust: 0.8
url:http://jvn.jp/vu/jvnvu93868849/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4424
Trust: 0.8
url:http://www.apple.com/server/macosx/
Trust: 0.3
url:https://www.apple.com/support/security/pgp/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4424
Trust: 0.3
url:http://gpgtools.org
Trust: 0.3
url:http://support.apple.com/kb/ht1222
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-0064
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0063
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0061
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0060
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0065
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0066
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-0062
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4406
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2013-6393
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4854
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-0591
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4164
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-3919
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4446
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4447
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3566
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72364 // 
            
            
            
            BID: 69918 // 
            
            
            
            JVNDB: JVNDB-2014-004306 // 
            
            
            
            PACKETSTORM: 128318 // 
            
            
            
            PACKETSTORM: 128317 // 
            
            
            
            PACKETSTORM: 128731 // 
            
            
            
            CNNVD: CNNVD-201409-716 // 
            
            
            
            NVD: CVE-2014-4424

CREDITS
Sajjad Pourali of CERT of Ferdowsi University of Mashhad
Trust: 0.3
sources:
            
            
            BID: 69918

SOURCES
db:VULHUBid:VHN-72364
db:BIDid:69918
db:JVNDBid:JVNDB-2014-004306
db:PACKETSTORMid:128318
db:PACKETSTORMid:128317
db:PACKETSTORMid:128731
db:CNNVDid:CNNVD-201409-716
db:NVDid:CVE-2014-4424

LAST UPDATE DATE
2024-11-23T20:53:54.848000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-72364date:2017-08-29T00:00:00
db:BIDid:69918date:2014-10-17T11:00:00
db:JVNDBid:JVNDB-2014-004306date:2014-09-22T00:00:00
db:CNNVDid:CNNVD-201409-716date:2014-09-22T00:00:00
db:NVDid:CVE-2014-4424date:2024-11-21T02:10:10

SOURCES RELEASE DATE
db:VULHUBid:VHN-72364date:2014-09-19T00:00:00
db:BIDid:69918date:2014-09-17T00:00:00
db:JVNDBid:JVNDB-2014-004306date:2014-09-22T00:00:00
db:PACKETSTORMid:128318date:2014-09-19T15:42:34
db:PACKETSTORMid:128317date:2014-09-19T15:35:55
db:PACKETSTORMid:128731date:2014-10-17T15:07:38
db:CNNVDid:CNNVD-201409-716date:2014-09-22T00:00:00
db:NVDid:CVE-2014-4424date:2014-09-19T10:55:04.153