var-200607-0331
Vulnerability from variot
WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a "memory management error" in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag. Apple Workgroup Manager fails to properly enable ShadowHash passwords in a NetInfo parent. Workgroup Manager may appear to use ShadowHash passwords when crypt is used. A vulnerability exists in how Apple OS X handles PICT images. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code, or create a denial-of-service condition. This vulnerability may allow remote users with a valid network account to bypass LoginWindow service access controls. Adobe Flash Player fails to properly handle malformed strings. Safari is prone to a buffer-overflow vulnerability. This issue is triggered when an attacker entices a victim user to visit a malicious website or to open a malicious HTML file. Failed exploit attempts result in crashing the application, effectively denying service to legitimate users. Possible buffer overflow.
Hardcore Disassembler / Reverse Engineer Wanted!
Want to work with IDA and BinDiff? Want to write PoC's and Exploits?
Your nationality is not important.
The vulnerability is caused due to an error in the "KHTMLParser::popOneBlock()" function. This can be exploited to cause a memory corruption via a script element in a div element redefining the document body.
The vulnerability has been confirmed in version 2.0.4 (419.3). Other versions may also be affected.
SOLUTION: Disable JavaScript support.
Want to work within IT-Security?
Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit.
Currently the following type of positions are available: http://secunia.com/quality_assurance_analyst/ http://secunia.com/web_application_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/
TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA22187
VERIFY ADVISORY: http://secunia.com/advisories/22187/
CRITICAL: Highly critical
IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, DoS, System access
WHERE:
From remote
OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/
DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.
1) An error in the CFNetwork component may allow a malicious SSL site to pose as a trusted SLL site to CFNetwork clients (e.g. Safari).
4) An error in the kernel's error handling mechanism known as Mach exception ports can be exploited by malicious, local users to execute arbitrary code in privileged applications.
5) An unchecked error condition in the LoginWindow component may result in Kerberos tickets being accessible to other local users after an unsuccessful attempt to log in.
6) Another error in the LoginWindow component during the handling of "Fast User Switching" may result in Kerberos tickets being accessible to other local users.
8) An error makes it possible for an account to manage WebObjects applications after the "Admin" privileges have been revoked.
9) A memory corruption error in QuickDraw Manager when processing PICT images can potentially be exploited via a specially crafted PICT image to execute arbitrary code.
10) An error in SASL can be exploited by malicious people to cause a DoS (Denial of Service) against the IMAP service.
For more information: SA19618
11) A memory management error in WebKit's handling of certain HTML can be exploited by malicious people to compromise a user's system.
SOLUTION: Update to version 10.4.8 or apply Security Update 2006-006. 3) The vendor credits Tom Saxton, Idle Loop Software Design. 4) The vendor credits Dino Dai Zovi, Matasano Security. 5) The vendor credits Patrick Gallagher, Digital Peaks Corporation. 6) The vendor credits Ragnar Sundblad, Royal Institute of Technology. 8) The vendor credits Phillip Tejada, Fruit Bat Software. 12) The vendor credits Chris Pepper, The Rockefeller University.
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=304460
OTHER REFERENCES: SA19618: http://secunia.com/advisories/19618/
SA20971: http://secunia.com/advisories/20971/
SA21271: http://secunia.com/advisories/21271/
SA21865: http://secunia.com/advisories/21865/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. visiting a malicious website.
2) An unspecified error can be exploited to bypass the "allowScriptAccess" option.
3) Unspecified errors exist in the way the ActiveX control is invoked by Microsoft Office products on Windows.
PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Stuart Pearson, Computer Terrorism UK Ltd, for reporting one of the vulnerabilities. 2) Reported by the vendor. 3) Reported by the vendor
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200607-0331",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": null,
"scope": null,
"trust": 5.6,
"vendor": "apple computer",
"version": null
},
{
"model": "safari",
"scope": "eq",
"trust": 1.9,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "adobe",
"version": null
},
{
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "microsoft",
"version": null
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.2"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.4"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.3.9"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.7"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.3"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.3.9"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4 to v10.4.7 up to version"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.3.9"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4 to v10.4.7 up to version"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "mobile safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#847468"
},
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "BID",
"id": "19250"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "hdm is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "19250"
}
],
"trust": 0.3
},
"cve": "CVE-2006-3946",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2006-3946",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-20054",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2006-3946",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#346396",
"trust": 0.8,
"value": "0.54"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#897628",
"trust": 0.8,
"value": "2.76"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#838404",
"trust": 0.8,
"value": "1.38"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#546772",
"trust": 0.8,
"value": "11.70"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#451380",
"trust": 0.8,
"value": "33.41"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#168372",
"trust": 0.8,
"value": "14.29"
},
{
"author": "NVD",
"id": "CVE-2006-3946",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200607-513",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-20054",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a \"memory management error\" in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag. Apple Workgroup Manager fails to properly enable ShadowHash passwords in a NetInfo parent. Workgroup Manager may appear to use ShadowHash passwords when crypt is used. A vulnerability exists in how Apple OS X handles PICT images. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code, or create a denial-of-service condition. This vulnerability may allow remote users with a valid network account to bypass LoginWindow service access controls. Adobe Flash Player fails to properly handle malformed strings. Safari is prone to a buffer-overflow vulnerability. This issue is triggered when an attacker entices a victim user to visit a malicious website or to open a malicious HTML file. Failed exploit attempts result in crashing the application, effectively denying service to legitimate users. Possible buffer overflow. \n\n----------------------------------------------------------------------\n\nHardcore Disassembler / Reverse Engineer Wanted!\n\nWant to work with IDA and BinDiff?\nWant to write PoC\u0027s and Exploits?\n\nYour nationality is not important. \n\nThe vulnerability is caused due to an error in the\n\"KHTMLParser::popOneBlock()\" function. This can be exploited to cause\na memory corruption via a script element in a div element redefining\nthe document body. \n\nThe vulnerability has been confirmed in version 2.0.4 (419.3). Other\nversions may also be affected. \n\nSOLUTION:\nDisable JavaScript support. \n\n----------------------------------------------------------------------\n\nWant to work within IT-Security?\n\nSecunia is expanding its team of highly skilled security experts. \nWe will help with relocation and obtaining a work permit. \n\nCurrently the following type of positions are available:\nhttp://secunia.com/quality_assurance_analyst/\nhttp://secunia.com/web_application_security_specialist/ \nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\n\n----------------------------------------------------------------------\n\nTITLE:\nMac OS X Security Update Fixes Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA22187\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/22187/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Spoofing, Exposure of sensitive information,\nPrivilege escalation, DoS, System access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple Macintosh OS X\nhttp://secunia.com/product/96/\n\nDESCRIPTION:\nApple has issued a security update for Mac OS X, which fixes multiple\nvulnerabilities. \n\n1) An error in the CFNetwork component may allow a malicious SSL site\nto pose as a trusted SLL site to CFNetwork clients (e.g. Safari). \n\n4) An error in the kernel\u0027s error handling mechanism known as Mach\nexception ports can be exploited by malicious, local users to execute\narbitrary code in privileged applications. \n\n5) An unchecked error condition in the LoginWindow component may\nresult in Kerberos tickets being accessible to other local users\nafter an unsuccessful attempt to log in. \n\n6) Another error in the LoginWindow component during the handling of\n\"Fast User Switching\" may result in Kerberos tickets being accessible\nto other local users. \n\n8) An error makes it possible for an account to manage WebObjects\napplications after the \"Admin\" privileges have been revoked. \n\n9) A memory corruption error in QuickDraw Manager when processing\nPICT images can potentially be exploited via a specially crafted PICT\nimage to execute arbitrary code. \n\n10) An error in SASL can be exploited by malicious people to cause a\nDoS (Denial of Service) against the IMAP service. \n\nFor more information:\nSA19618\n\n11) A memory management error in WebKit\u0027s handling of certain HTML\ncan be exploited by malicious people to compromise a user\u0027s system. \n\nSOLUTION:\nUpdate to version 10.4.8 or apply Security Update 2006-006. \n3) The vendor credits Tom Saxton, Idle Loop Software Design. \n4) The vendor credits Dino Dai Zovi, Matasano Security. \n5) The vendor credits Patrick Gallagher, Digital Peaks Corporation. \n6) The vendor credits Ragnar Sundblad, Royal Institute of\nTechnology. \n8) The vendor credits Phillip Tejada, Fruit Bat Software. \n12) The vendor credits Chris Pepper, The Rockefeller University. \n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=304460\n\nOTHER REFERENCES:\nSA19618:\nhttp://secunia.com/advisories/19618/\n\nSA20971:\nhttp://secunia.com/advisories/20971/\n\nSA21271:\nhttp://secunia.com/advisories/21271/\n\nSA21865:\nhttp://secunia.com/advisories/21865/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. visiting a malicious website. \n\n2) An unspecified error can be exploited to bypass the\n\"allowScriptAccess\" option. \n\n3) Unspecified errors exist in the way the ActiveX control is invoked\nby Microsoft Office products on Windows. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) The vendor credits Stuart Pearson, Computer Terrorism UK Ltd, for\nreporting one of the vulnerabilities. \n2) Reported by the vendor. \n3) Reported by the vendor",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-3946"
},
{
"db": "CERT/CC",
"id": "VU#847468"
},
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "BID",
"id": "19250"
},
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "PACKETSTORM",
"id": "48714"
},
{
"db": "PACKETSTORM",
"id": "50441"
},
{
"db": "PACKETSTORM",
"id": "49912"
}
],
"trust": 7.29
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "SECUNIA",
"id": "22187",
"trust": 5.8
},
{
"db": "BID",
"id": "19250",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "21271",
"trust": 2.6
},
{
"db": "NVD",
"id": "CVE-2006-3946",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "21865",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1016957",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-3069",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-3852",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "27534",
"trust": 1.7
},
{
"db": "CERT/CC",
"id": "VU#847468",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#346396",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#897628",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#838404",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#546772",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#451380",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#168372",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513",
"trust": 0.7
},
{
"db": "XF",
"id": "28081",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2006-09-29",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-20054",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "48714",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "50441",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "49912",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#847468"
},
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "BID",
"id": "19250"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "PACKETSTORM",
"id": "48714"
},
{
"db": "PACKETSTORM",
"id": "50441"
},
{
"db": "PACKETSTORM",
"id": "49912"
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"id": "VAR-200607-0331",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-20054"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:16:49.737000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Mac OS X 10.4.8 Update (Intel)",
"trust": 0.8,
"url": "http://www.apple.com/support/downloads/macosx1048updateintel.html"
},
{
"title": "Mac OS X 10.4.8 Update (PPC)",
"trust": 0.8,
"url": "http://www.apple.com/support/downloads/macosx1048updateppc.html"
},
{
"title": "Mac OS X 10.4.8 and Security Update 2006-006",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=304460"
},
{
"title": "Mac OS X 10.4.8 and Security Update 2006-006",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=304460-ja"
},
{
"title": "Mac OS X 10.4.8 Update (Intel)",
"trust": 0.8,
"url": "http://www.apple.com/jp/ftp-info/reference/macosx1048updateintel.html"
},
{
"title": "Mac OS X 10.4.8 Update (PPC)",
"trust": 0.8,
"url": "http://www.apple.com/jp/ftp-info/reference/macosx1048updateppc.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "http://secunia.com/advisories/22187/"
},
{
"trust": 4.1,
"url": "http://docs.info.apple.com/article.html?artnum=304460"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/19250"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/21271"
},
{
"trust": 2.1,
"url": "http://browserfun.blogspot.com/2006/07/mobb-31-safari-khtmlparserpoponeblock.html"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/21865/"
},
{
"trust": 1.7,
"url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2006/sep/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/27534"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1016957"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/22187"
},
{
"trust": 1.6,
"url": "http://www.microsoft.com/technet/security/bulletin/ms06-069.mspx"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2006/3069"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/3069"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/3852"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28081"
},
{
"trust": 0.9,
"url": "http://www.microsoft.com/technet/security/advisory/925143.mspx"
},
{
"trust": 0.8,
"url": "http://www.cert.org/tech_tips/home_networks.html#iv"
},
{
"trust": 0.8,
"url": "http://www.macintouch.com/index.shtml#other.2006.10.03.xvul"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=d9c2fe33"
},
{
"trust": 0.8,
"url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_16494"
},
{
"trust": 0.8,
"url": "http://www.adobe.com/devnet/security/security_zone/mpsb02-08.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-3946"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2006-3946"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/28081"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/3852"
},
{
"trust": 0.3,
"url": "http://www.apple.com/safari/"
},
{
"trust": 0.3,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/21271/"
},
{
"trust": 0.2,
"url": "http://secunia.com/quality_assurance_analyst/"
},
{
"trust": 0.2,
"url": "http://secunia.com/web_application_security_specialist/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5289/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate20060061039server.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosxserver1048updateppc.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosxserver1048comboupdateppc.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20971/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosx1048comboupdateintel.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate20060061039client.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosxserver1048updateuniversal.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/19618/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosx1048updateintel.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosx1048updateppc.html"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/macosx1048comboupdateppc.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/96/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/3191/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/6153/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/3192/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/2634/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/7024/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5246/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#847468"
},
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "BID",
"id": "19250"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "PACKETSTORM",
"id": "48714"
},
{
"db": "PACKETSTORM",
"id": "50441"
},
{
"db": "PACKETSTORM",
"id": "49912"
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#847468"
},
{
"db": "CERT/CC",
"id": "VU#346396"
},
{
"db": "CERT/CC",
"id": "VU#897628"
},
{
"db": "CERT/CC",
"id": "VU#838404"
},
{
"db": "CERT/CC",
"id": "VU#546772"
},
{
"db": "CERT/CC",
"id": "VU#451380"
},
{
"db": "CERT/CC",
"id": "VU#168372"
},
{
"db": "VULHUB",
"id": "VHN-20054"
},
{
"db": "BID",
"id": "19250"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"db": "PACKETSTORM",
"id": "48714"
},
{
"db": "PACKETSTORM",
"id": "50441"
},
{
"db": "PACKETSTORM",
"id": "49912"
},
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#847468"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#346396"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#897628"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#838404"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#546772"
},
{
"date": "2006-09-18T00:00:00",
"db": "CERT/CC",
"id": "VU#451380"
},
{
"date": "2006-09-20T00:00:00",
"db": "CERT/CC",
"id": "VU#168372"
},
{
"date": "2006-07-31T00:00:00",
"db": "VULHUB",
"id": "VHN-20054"
},
{
"date": "2006-07-29T00:00:00",
"db": "BID",
"id": "19250"
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"date": "2006-08-02T08:14:26",
"db": "PACKETSTORM",
"id": "48714"
},
{
"date": "2006-10-03T01:14:36",
"db": "PACKETSTORM",
"id": "50441"
},
{
"date": "2006-09-12T22:17:26",
"db": "PACKETSTORM",
"id": "49912"
},
{
"date": "2006-07-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"date": "2006-07-31T23:04:00",
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-11-21T00:00:00",
"db": "CERT/CC",
"id": "VU#847468"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#346396"
},
{
"date": "2006-10-02T00:00:00",
"db": "CERT/CC",
"id": "VU#897628"
},
{
"date": "2006-10-04T00:00:00",
"db": "CERT/CC",
"id": "VU#838404"
},
{
"date": "2006-11-21T00:00:00",
"db": "CERT/CC",
"id": "VU#546772"
},
{
"date": "2007-07-11T00:00:00",
"db": "CERT/CC",
"id": "VU#451380"
},
{
"date": "2006-11-14T00:00:00",
"db": "CERT/CC",
"id": "VU#168372"
},
{
"date": "2017-07-20T00:00:00",
"db": "VULHUB",
"id": "VHN-20054"
},
{
"date": "2006-09-29T22:10:00",
"db": "BID",
"id": "19250"
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-000663"
},
{
"date": "2006-10-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200607-513"
},
{
"date": "2024-11-21T00:14:46.710000",
"db": "NVD",
"id": "CVE-2006-3946"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Workgroup Manager fails to properly enable ShadowHash passwords",
"sources": [
{
"db": "CERT/CC",
"id": "VU#847468"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200607-513"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…