Sign-up

ID

VAR-201509-0048


CVE

CVE-2015-5910


TITLE

Apple Xcode of IDE Xcode Vulnerability in server where important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2015-004795

DESCRIPTION

IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network. Apple Xcode is prone to multiple security bypass vulnerabilities. Attackers can exploit these issues to bypass security restrictions and perform other attacks. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. IDE Xcode Server is one of the integrated development tools. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-09-16-2 Xcode 7.0 Xcode 7.0 is now available and addresses the following: DevTools Available for: OS X Yosemite v10.10.4 or later Impact: An attacker may be able to bypass access restrictions Description: An API issue existed in the apache configuration. This issue was addressed by updating header files to use the latest version. CVE-ID CVE-2015-3185 : Branko Aibej of the Apache Software Foundation IDE Xcode Server Available for: OS X Yosemite 10.10 or later Impact: An attacker may be able to access restricted parts of the filesystem Description: A comparison issue existed in the node.js send module prior to version 0.8.4. This issue was addressed by upgrading to version 0.12.3. CVE-ID CVE-2014-6394 : Ilya Kantor IDE Xcode Server Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilties in OpenSSL Description: Multiple vulnerabilties existed in the node.js OpenSSL module prior to version 1.0.1j. These issues were addressed by updating openssl to version 1.0.1j. This issue was addressed through improved network connection logic. CVE-ID CVE-2015-5910 : an anonymous researcher IDE Xcode Server Available for: OS X Yosemite v10.10.4 or later Impact: Build notifications may be sent to unintended recipients Description: An access issue existed in the handling of repository email lists. This issue was addressed through improved validation. CVE-ID CVE-2015-5909 : Daniel Tomlinson of Rocket Apps, David Gatwood of Anchorfree subversion Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilities existed in svn versions prior to 1.7.19 Description: Multiple vulnerabilities existed in svn versions prior to 1.7.19. These issues were addressed by updating svn to version 1.7.20. CVE-ID CVE-2015-0248 CVE-2015-0251 Xcode 7.0 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "7.0". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJV+axlAAoJEBcWfLTuOo7tzuMQAJhCQaeClT0rDozh+WlKgM6f X86xFeXLJ1gjlPKH183Bvm2gTW0m5kQuoNK1grarMB+rEeb8mPsOczwrIJisxVlr 5zkW/7JktHcsBU5vUa4j4T/CEJjp92VPZ4ub3k3eQOrhinn4E86uKcMxrYoQOAE0 YFMSDaPBFy+LIJ08ROB/AH8fkGJMLRCRAp43IGgzNuxCDx9jzW97m1dh86mR1CxP GdhWRvN7T5YqXyJTw6pZbEHtVXjty8appe2ScvHByCRxa4gZq+/JinHInLjaB4p7 3o58rAWh7lDhcEi3HqkIu0YW6fLslPydCHTI4cH1PCHTuevNjjvK34IqMbD0jG/t tO+vQFhwXpD5chsSB2oP2zLOWAJ7BA5uwvArkJhGKKzQ5DEI0soLBWG7Koe3RitO HokIMyx0r+sf4YD+OP4RVPU9bU4FpayXZnECmHzWmK2vguihbIzjxq+Knvx7aiF9 js1Qn0DxT2puVYdhixtkvYKT7r8XRjI8MPLEwS+tX1Yg1Lqhz2G1MR6mO9iBW56L g5deOuCVc56qeaobuUK0clvdFYtyd5jIXgh0zspZ4ssCbbdCOTZUQaG1mBGkIf3R JgWTX8ny1Fdk9om3dmZVWUCzzqxJR/tm5M7kjGc425ZGaoBRWLga1VIjNz7MEfKS YMBNmqt6weEewNqyDMnX =SGgX -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2015-5910 // JVNDB: JVNDB-2015-004795 // BID: 76773 // VULHUB: VHN-83871 // PACKETSTORM: 133617

AFFECTED PRODUCTS

vendor:applemodel:xcodescope:lteversion:6.4

Trust: 1.0

vendor:applemodel:xcodescope:ltversion:7.0 (os x yosemite v10.10.4 or later )

Trust: 0.8

vendor:applemodel:xcodescope:eqversion:6.4

Trust: 0.6

vendor:applemodel:xcodescope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.4.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:6.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:6.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:6.0

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:5.0

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.4

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.1.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:4.0

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.2.5

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.2.4

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.2.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1.4

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.0

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.4

Trust: 0.3

vendor:applemodel:xcodescope:neversion:7.0

Trust: 0.3

sources: BID: 76773 // JVNDB: JVNDB-2015-004795 // CNNVD: CNNVD-201509-363 // NVD: CVE-2015-5910

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-5910
value: LOW

Trust: 1.0

NVD: CVE-2015-5910
value: LOW

Trust: 0.8

CNNVD: CNNVD-201509-363
value: LOW

Trust: 0.6

VULHUB: VHN-83871
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2015-5910
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-83871
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:P/I:N/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-83871 // JVNDB: JVNDB-2015-004795 // CNNVD: CNNVD-201509-363 // NVD: CVE-2015-5910

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-83871 // JVNDB: JVNDB-2015-004795 // NVD: CVE-2015-5910

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201509-363

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201509-363

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-004795

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2015-09-16-2 Xcode 7.0url:http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
Trust: 0.8
title:HT205217url:https://support.apple.com/en-us/HT205217
Trust: 0.8
title:HT205217url:http://support.apple.com/ja-jp/HT205217
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-004795

EXTERNAL IDS
db:NVDid:CVE-2015-5910
Trust: 2.9
db:SECTRACKid:1033596
Trust: 1.1
db:JVNid:JVNVU99970459
Trust: 0.8
db:JVNDBid:JVNDB-2015-004795
Trust: 0.8
db:CNNVDid:CNNVD-201509-363
Trust: 0.7
db:BIDid:76773
Trust: 0.3
db:VULHUBid:VHN-83871
Trust: 0.1
db:PACKETSTORMid:133617
Trust: 0.1
sources:
            
            
            VULHUB: VHN-83871 // 
            
            
            
            BID: 76773 // 
            
            
            
            JVNDB: JVNDB-2015-004795 // 
            
            
            
            PACKETSTORM: 133617 // 
            
            
            
            CNNVD: CNNVD-201509-363 // 
            
            
            
            NVD: CVE-2015-5910

REFERENCES
url:http://lists.apple.com/archives/security-announce/2015/sep/msg00002.html
Trust: 1.7
url:https://support.apple.com/ht205217
Trust: 1.7
url:http://www.securitytracker.com/id/1033596
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5910
Trust: 0.8
url:http://jvn.jp/vu/jvnvu99970459/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5910
Trust: 0.8
url:http://www.apple.com/macosx/
Trust: 0.3
url:https://developer.apple.com/xcode/
Trust: 0.3
url:https://support.apple.com/en-us/ht205217 
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-0248
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3567
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5910
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-3185
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3568
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3513
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://developer.apple.com/xcode/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-6394
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0251
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5909
Trust: 0.1
url:http://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3566
Trust: 0.1
sources:
            
            
            VULHUB: VHN-83871 // 
            
            
            
            BID: 76773 // 
            
            
            
            JVNDB: JVNDB-2015-004795 // 
            
            
            
            PACKETSTORM: 133617 // 
            
            
            
            CNNVD: CNNVD-201509-363 // 
            
            
            
            NVD: CVE-2015-5910

CREDITS
an anonymous researcher and Daniel Tomlinson of Rocket Apps, David Gatwood of Anchorfree
Trust: 0.3
sources:
            
            
            BID: 76773

SOURCES
db:VULHUBid:VHN-83871
db:BIDid:76773
db:JVNDBid:JVNDB-2015-004795
db:PACKETSTORMid:133617
db:CNNVDid:CNNVD-201509-363
db:NVDid:CVE-2015-5910

LAST UPDATE DATE
2024-11-23T20:44:55.003000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-83871date:2016-12-22T00:00:00
db:BIDid:76773date:2015-09-16T00:00:00
db:JVNDBid:JVNDB-2015-004795date:2015-09-25T00:00:00
db:CNNVDid:CNNVD-201509-363date:2015-09-24T00:00:00
db:NVDid:CVE-2015-5910date:2024-11-21T02:34:06.953

SOURCES RELEASE DATE
db:VULHUBid:VHN-83871date:2015-09-18T00:00:00
db:BIDid:76773date:2015-09-16T00:00:00
db:JVNDBid:JVNDB-2015-004795date:2015-09-25T00:00:00
db:PACKETSTORMid:133617date:2015-09-19T15:31:48
db:CNNVDid:CNNVD-201509-363date:2015-09-21T00:00:00
db:NVDid:CVE-2015-5910date:2015-09-18T12:00:52.277