ID CVE-2007-5863
Summary Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server, using a modified distribution definition file with the "allow-external-scripts" option.
References
Vulnerable Configurations
  • cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 15-10-2018 - 21:46)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
apple APPLE-SA-2007-12-17
bid 26908
bugtraq 20071217 Apple OS X Software Update Remote Command Execution
cert TA07-352A
confirm http://docs.info.apple.com/article.html?artnum=307179
sectrack 1019106
secunia 28136
vupen ADV-2007-4238
xf macos-software-update-command-execution(39111)
Last major update 15-10-2018 - 21:46
Published 19-12-2007 - 21:46
Back to Top