var-200712-0398
Vulnerability from variot
Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long workgroup (-W) option to mount_smbfs or (2) an unspecified manipulation of the command line to smbutil. Mac OS X is prone to a local stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. This issue affects certain SMB (Server Message Block protocol) applications. An attacker can exploit this issue to execute arbitrary code with superuser privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will result in a denial of service. Mac OS X and Mac OS X Server 10.4.11 and prior versions are vulnerable. NOTE: This issue was originally covered in BID 26910 (Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities). Flash Player is a very popular FLASH player. There is a vulnerability in the way that the Flash Player plug-in creates TCP sessions with other hosts through (SWF) movies. Attackers may use this vulnerability to lure users to connect to malicious files. After receiving the allow-access-from element in the cross-domain policy XML document, Flash Player does not bind the hostname to a single IP address, and the Flash Socket class does not use the browser's DNS binding, so the attacker can pass A DNS rebinding attack causes the victim user's machine to create a TCP session to an arbitrary host. BACKGROUND
The mount_smbfs utility is used to mount a remote SMB share locally. It is installed set-uid root, so as to allow unprivileged users to mount shares, and is present in a default installation on both the Server and Desktop versions of Mac OS X. For more information visit the following URL.
http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/mount_smbfs.8.html
II.
The vulnerability exists in a portion of code responsible for parsing command line arguments. When processing the -W option, which is used to specify a workgroup name, the option's argument is copied into a fixed sized stack buffer without any checks on its length. This leads to a trivially exploitable stack based buffer overflow.
III.
IV. Previous versions may also be affected.
V. WORKAROUND
Removing the set-uid bit from the mount_smbfs binary will prevent exploitation. However, non-root users will be unable to use the program.
VI. More information is available at the following URL.
http://docs.info.apple.com/article.html?artnum=307179
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-3876 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
07/16/2007 Initial vendor notification 07/17/2007 Initial vendor response 12/17/2007 Coordinated public disclosure
IX. CREDIT
This vulnerability was discovered by Sean Larsson of VeriSign iDefense Labs.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2007 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
I. Further details are available in the related vulnerability notes. These products include: * Adobe Flash * Adobe Shockwave * GNU Tar
II. Impact
The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, surreptitious video conference initiation, and denial of service. This and other updates are available via Software Update or via Apple Downloads. Please send email to cert@cert.org with "TA07-352A Feedback VU#905292" in the subject.
For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.
Produced 2007 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
Revision History
December 18, 2007: Initial release
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBR2hR0fRFkHkM87XOAQL7Egf+NvQEwnN2IGDdDwMEb9C2RDw58FXq0EMZ 7SRO8qbrM0c+G3apLFlmCCivWpGHqms2hzrSeon/Ym1YstHQOQeoJANmsHA3SyKz Wx8TIG10jEiAgytMuyrYjf0w3alXBEsDgXcu8FRc5Z4dg7osMPe7Lco7vVfMvoZG IpEEQu98zxh2p+Vhf1XKr9UfUnkD4O88rRAs+M1oDZd46GH+JvkYLgLCmkMSwIcs Vi4M7J+KHUBBkaMZYjnp+YqRwNDq9sGskVEOVDMk9OXw7VhAR7Kf8/zo9Tt1h3P0 h9JeMBHHb0M0MEtYHx/7JxpleXS3LtyiL0kDb9cbMjxU0kKK9SKb/Q== =Y1jd -----END PGP SIGNATURE----- .
2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published
How do you know which Secunia advisories are important to you?
The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively.
1) A format string error in the URL handler of Address Book can be exploited to execute arbitrary code when a user views a specially crafted web page.
2) An error in the handling of downloaded files in CFNetwork can be exploited via directory traversal attacks to automatically download files to arbitrary folders when a user is enticed to visit a specially crafted web page.
3) An unspecified error exists in ColorSync when processing images with an embedded ColorSync profile, which can be exploited to cause a memory corruption.
Successful exploitation may allow execution of arbitrary code.
4) A race condition exists in the "CFURLWriteDataAndPropertiesToResource" API, which can lead to files being created with insecure permissions.
5) A boundary error exists in the printer driver for CUPS. This can be exploited to cause a buffer overflow and allows an admin user to execute arbitrary code with system privileges by passing a specially crafted URI to the CUPS service.
6) A boundary error in CUPS can be exploited by malicious people to compromise a vulnerable system.
For more information: SA27233
7) An integer underflow error in the CUPS backend in the handling of SNMP responses can be exploited to cause a stack-based buffer overflow by sending a specially crafted SNMP response.
Successful exploitation allows execution of arbitrary code, but requires that SNMP is enabled.
8) A boundary error in Desktop Services can be exploited to cause a heap-based buffer overflow when a user opens a directory containing a specially crafted .DS_Store file.
Successful exploitation may allow execution of arbitrary code.
9) An input validation error in tar can be exploited by malicious people to compromise a user's system.
For more information: SA26573
10) An unspecified error in iChat can be exploited by malicious people on the local network to initiate a video connection without the user's approval.
11) An unspecified error exists within IO Storage Family when handling GUID partition maps within a disk image.
12) Launch Services does not handle HTML files as potentially unsafe content. This can be exploited to disclose sensitive information or conduct cross-site scripting attacks by enticing a user to open a specially crafted HTML file.
13) A vulnerability in Mail in the handling of unsafe file types can be exploited to compromise a user's system.
For more information: SA27785
14) An error in Mail can cause the application to default to SMTP plaintext authentication if the server supports only MD5 Challenge-Response authentication and plaintext authentication.
15) Some vulnerabilities in perl can be exploited by malicious people to compromise a vulnerable system.
For more information: SA27546
16) A security issue in python can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.
For more information: SA26837
17) Plug-ins in Quick Look are not restricted from making network requests. This may lead to the disclosure of sensitive information when previewing an HTML file.
18) URLs contained in movie files may be accessed when creating an icon for a movie file or previewing a movie file using QuickLook.
19) Some security issues in ruby can be exploited by malicious people to conduct spoofing attacks.
For more information: SA26985
20) Some vulnerabilities and a security issue in Ruby on Rails can be exploited by malicious people to disclose sensitive information or to conduct session fixation attacks.
For more information: SA25699 SA27781
21) An error in Safari allows a page to navigate the subframes of any other page. This can be exploited to conduct cross-site scripting attacks and to disclose sensitive information when a user visits a specially crafted web page.
22) An unspecified error in Safari in the handling of RSS feeds can be exploited to cause a memory corruption and may allow execution of arbitrary code when a user accesses a specially crafted URL.
23) Some boundary errors in Samba can be exploited by malicious people to compromise a vulnerable system.
For more information: SA27450
24) Some boundary errors in the Shockwave Plug-in can be exploited by malicious people to compromise a user's system.
26) The distribution definition file used in Software Update is received by using HTTP without any authentication and allows execution of arbitrary commands.
Successful exploitation requires a MitM (Man-in-the-Middle) attack.
27) An error due to an insecure file operation exists in the handling of output files in SpinTracer.
28) An unspecified error exists in the Microsoft Office Spotlight Importer, which can be exploited to cause a memory corruption when a user downloads a specially crafted .xls file.
Successful exploitation may allow execution of arbitrary code.
29) Some vulnerabilities in tcpdump can be exploited by malicious people to cause a DoS or to compromise a user's system.
For more information: SA24318 SA26135
30) Some vulnerabilities exist the Perl Compatible Regular Expressions (PCRE) library used by XQuery, which can potentially be exploited to compromise a vulnerable system.
For more information: SA27543
SOLUTION: Apply Security Update 2007-009.
Security Update 2007-009 (10.4.11 Universal): http://www.apple.com/support/downloads/securityupdate200700910411universal.html
Security Update 2007-009 (10.4.11 PPC): http://www.apple.com/support/downloads/securityupdate200700910411ppc.html
Security Update 2007-009 (10.5.1): http://www.apple.com/support/downloads/securityupdate20070091051.html
PROVIDED AND/OR DISCOVERED BY: 2) The vendor credits Sean Harding. 3) The vendor credits Tom Ferris, Adobe Secure Software Engineering Team (ASSET). 5) The vendor credits Dave Camp, Critical Path Software. 7) The vendor credits Wei Wang, McAfee Avert Labs. 12) The vendor credits Michal Zalewski, Google Inc. 15) The vendor credits Tavis Ormandy and Will Drewry, Google Security Team. 18) The vendor credits Lukhnos D. Liu, Lithoglyph Inc. 26) Moritz Jodeit. 27) The vendor credits Kevin Finisterre, DigitalMunition
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307179
OTHER REFERENCES: SA19218: http://secunia.com/advisories/19218/
SA24318: http://secunia.com/advisories/24318/
SA25699: http://secunia.com/advisories/25699/
SA26135: http://secunia.com/advisories/26135/
SA26573: http://secunia.com/advisories/26573/
SA26837: http://secunia.com/advisories/26837/
SA26985: http://secunia.com/advisories/26985/
SA27233: http://secunia.com/advisories/27233/
SA27450: http://secunia.com/advisories/27450/
SA27543: http://secunia.com/advisories/27543/
SA27546: http://secunia.com/advisories/27546/
SA27781: http://secunia.com/advisories/27781/
SA27785: http://secunia.com/advisories/27785/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200712-0398",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.11"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "directory pro",
"scope": "eq",
"trust": 0.3,
"vendor": "cosmicperl",
"version": "10.0.3"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.11"
}
],
"sources": [
{
"db": "BID",
"id": "26926"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Collin Jackson collinj@cs.stanford.edu",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
}
],
"trust": 0.6
},
"cve": "CVE-2007-3876",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CVE-2007-3876",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-27238",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-3876",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-3876",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200712-231",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-27238",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long workgroup (-W) option to mount_smbfs or (2) an unspecified manipulation of the command line to smbutil. Mac OS X is prone to a local stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. \nThis issue affects certain SMB (Server Message Block protocol) applications. \nAn attacker can exploit this issue to execute arbitrary code with superuser privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will result in a denial of service. \nMac OS X and Mac OS X Server 10.4.11 and prior versions are vulnerable. \nNOTE: This issue was originally covered in BID 26910 (Apple Mac OS X v10.5.1 2007-009 Multiple Security Vulnerabilities). Flash Player is a very popular FLASH player. There is a vulnerability in the way that the Flash Player plug-in creates TCP sessions with other hosts through (SWF) movies. Attackers may use this vulnerability to lure users to connect to malicious files. After receiving the allow-access-from element in the cross-domain policy XML document, Flash Player does not bind the hostname to a single IP address, and the Flash Socket class does not use the browser\u0027s DNS binding, so the attacker can pass A DNS rebinding attack causes the victim user\u0027s machine to create a TCP session to an arbitrary host. BACKGROUND\n\nThe mount_smbfs utility is used to mount a remote SMB share locally. It\nis installed set-uid root, so as to allow unprivileged users to mount\nshares, and is present in a default installation on both the Server and\nDesktop versions of Mac OS X. For more information visit the following\nURL. \n\nhttp://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/mount_smbfs.8.html\n\nII. \n\nThe vulnerability exists in a portion of code responsible for parsing\ncommand line arguments. When processing the -W option, which is used to\nspecify a workgroup name, the option\u0027s argument is copied into a fixed\nsized stack buffer without any checks on its length. This leads to a\ntrivially exploitable stack based buffer overflow. \n\nIII. \n\nIV. Previous\nversions may also be affected. \n\nV. WORKAROUND\n\nRemoving the set-uid bit from the mount_smbfs binary will prevent\nexploitation. However, non-root users will be unable to use the\nprogram. \n\nVI. More information is available at the following URL. \n\nhttp://docs.info.apple.com/article.html?artnum=307179\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2007-3876 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n07/16/2007 Initial vendor notification\n07/17/2007 Initial vendor response\n12/17/2007 Coordinated public disclosure\n\nIX. CREDIT\n\nThis vulnerability was discovered by Sean Larsson of VeriSign iDefense\nLabs. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2007 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically,\nplease e-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct,\nindirect, or consequential loss or damage arising from use of, or\nreliance on, this information. \n\nI. \n Further details are available in the related vulnerability notes. These products include:\n * Adobe Flash\n * Adobe Shockwave\n * GNU Tar\n\nII. Impact\n\n The impacts of these vulnerabilities vary. Potential consequences\n include arbitrary code execution, sensitive information disclosure,\n surreptitious video conference initiation, and denial of service. This and other updates are\n available via Software Update or via Apple Downloads. Please send\n email to \u003ccert@cert.org\u003e with \"TA07-352A Feedback VU#905292\" in the\n subject. \n _________________________________________________________________\n\n For instructions on subscribing to or unsubscribing from this\n mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n _________________________________________________________________\n\n Produced 2007 by US-CERT, a government organization. \n\n Terms of use:\n\n \u003chttp://www.us-cert.gov/legal.html\u003e\n _________________________________________________________________\n\nRevision History\n\n December 18, 2007: Initial release\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBR2hR0fRFkHkM87XOAQL7Egf+NvQEwnN2IGDdDwMEb9C2RDw58FXq0EMZ\n7SRO8qbrM0c+G3apLFlmCCivWpGHqms2hzrSeon/Ym1YstHQOQeoJANmsHA3SyKz\nWx8TIG10jEiAgytMuyrYjf0w3alXBEsDgXcu8FRc5Z4dg7osMPe7Lco7vVfMvoZG\nIpEEQu98zxh2p+Vhf1XKr9UfUnkD4O88rRAs+M1oDZd46GH+JvkYLgLCmkMSwIcs\nVi4M7J+KHUBBkaMZYjnp+YqRwNDq9sGskVEOVDMk9OXw7VhAR7Kf8/zo9Tt1h3P0\nh9JeMBHHb0M0MEtYHx/7JxpleXS3LtyiL0kDb9cbMjxU0kKK9SKb/Q==\n=Y1jd\n-----END PGP SIGNATURE-----\n. \n----------------------------------------------------------------------\n\n2003: 2,700 advisories published\n2004: 3,100 advisories published\n2005: 4,600 advisories published\n2006: 5,300 advisories published\n\nHow do you know which Secunia advisories are important to you?\n\nThe Secunia Vulnerability Intelligence Solutions allows you to filter\nand structure all the information you need, so you can address issues\neffectively. \n\n1) A format string error in the URL handler of Address Book can be\nexploited to execute arbitrary code when a user views a specially\ncrafted web page. \n\n2) An error in the handling of downloaded files in CFNetwork can be\nexploited via directory traversal attacks to automatically download\nfiles to arbitrary folders when a user is enticed to visit a\nspecially crafted web page. \n\n3) An unspecified error exists in ColorSync when processing images\nwith an embedded ColorSync profile, which can be exploited to cause a\nmemory corruption. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n4) A race condition exists in the\n\"CFURLWriteDataAndPropertiesToResource\" API, which can lead to files\nbeing created with insecure permissions. \n\n5) A boundary error exists in the printer driver for CUPS. This can\nbe exploited to cause a buffer overflow and allows an admin user to\nexecute arbitrary code with system privileges by passing a specially\ncrafted URI to the CUPS service. \n\n6) A boundary error in CUPS can be exploited by malicious people to\ncompromise a vulnerable system. \n\nFor more information:\nSA27233\n\n7) An integer underflow error in the CUPS backend in the handling of\nSNMP responses can be exploited to cause a stack-based buffer\noverflow by sending a specially crafted SNMP response. \n\nSuccessful exploitation allows execution of arbitrary code, but\nrequires that SNMP is enabled. \n\n8) A boundary error in Desktop Services can be exploited to cause a\nheap-based buffer overflow when a user opens a directory containing a\nspecially crafted .DS_Store file. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n9) An input validation error in tar can be exploited by malicious\npeople to compromise a user\u0027s system. \n\nFor more information:\nSA26573\n\n10) An unspecified error in iChat can be exploited by malicious\npeople on the local network to initiate a video connection without\nthe user\u0027s approval. \n\n11) An unspecified error exists within IO Storage Family when\nhandling GUID partition maps within a disk image. \n\n12) Launch Services does not handle HTML files as potentially unsafe\ncontent. This can be exploited to disclose sensitive information or\nconduct cross-site scripting attacks by enticing a user to open a\nspecially crafted HTML file. \n\n13) A vulnerability in Mail in the handling of unsafe file types can\nbe exploited to compromise a user\u0027s system. \n\nFor more information:\nSA27785\n\n14) An error in Mail can cause the application to default to SMTP\nplaintext authentication if the server supports only MD5\nChallenge-Response authentication and plaintext authentication. \n\n15) Some vulnerabilities in perl can be exploited by malicious people\nto compromise a vulnerable system. \n\nFor more information:\nSA27546\n\n16) A security issue in python can be exploited by malicious people\nto cause a DoS (Denial of Service) and potentially compromise a\nvulnerable system. \n\nFor more information:\nSA26837\n\n17) Plug-ins in Quick Look are not restricted from making network\nrequests. This may lead to the disclosure of sensitive information\nwhen previewing an HTML file. \n\n18) URLs contained in movie files may be accessed when creating an\nicon for a movie file or previewing a movie file using QuickLook. \n\n19) Some security issues in ruby can be exploited by malicious people\nto conduct spoofing attacks. \n\nFor more information:\nSA26985\n\n20) Some vulnerabilities and a security issue in Ruby on Rails can be\nexploited by malicious people to disclose sensitive information or to\nconduct session fixation attacks. \n\nFor more information:\nSA25699\nSA27781\n\n21) An error in Safari allows a page to navigate the subframes of any\nother page. This can be exploited to conduct cross-site scripting\nattacks and to disclose sensitive information when a user visits a\nspecially crafted web page. \n\n22) An unspecified error in Safari in the handling of RSS feeds can\nbe exploited to cause a memory corruption and may allow execution of\narbitrary code when a user accesses a specially crafted URL. \n\n23) Some boundary errors in Samba can be exploited by malicious\npeople to compromise a vulnerable system. \n\nFor more information:\nSA27450\n\n24) Some boundary errors in the Shockwave Plug-in can be exploited by\nmalicious people to compromise a user\u0027s system. \n\n26) The distribution definition file used in Software Update is\nreceived by using HTTP without any authentication and allows\nexecution of arbitrary commands. \n\nSuccessful exploitation requires a MitM (Man-in-the-Middle) attack. \n\n27) An error due to an insecure file operation exists in the handling\nof output files in SpinTracer. \n\n28) An unspecified error exists in the Microsoft Office Spotlight\nImporter, which can be exploited to cause a memory corruption when a\nuser downloads a specially crafted .xls file. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n29) Some vulnerabilities in tcpdump can be exploited by malicious\npeople to cause a DoS or to compromise a user\u0027s system. \n\nFor more information:\nSA24318\nSA26135\n\n30) Some vulnerabilities exist the Perl Compatible Regular\nExpressions (PCRE) library used by XQuery, which can potentially be\nexploited to compromise a vulnerable system. \n\nFor more information:\nSA27543\n\nSOLUTION:\nApply Security Update 2007-009. \n\nSecurity Update 2007-009 (10.4.11 Universal):\nhttp://www.apple.com/support/downloads/securityupdate200700910411universal.html\n\nSecurity Update 2007-009 (10.4.11 PPC):\nhttp://www.apple.com/support/downloads/securityupdate200700910411ppc.html\n\nSecurity Update 2007-009 (10.5.1):\nhttp://www.apple.com/support/downloads/securityupdate20070091051.html\n\nPROVIDED AND/OR DISCOVERED BY:\n2) The vendor credits Sean Harding. \n3) The vendor credits Tom Ferris, Adobe Secure Software Engineering\nTeam (ASSET). \n5) The vendor credits Dave Camp, Critical Path Software. \n7) The vendor credits Wei Wang, McAfee Avert Labs. \n12) The vendor credits Michal Zalewski, Google Inc. \n15) The vendor credits Tavis Ormandy and Will Drewry, Google Security\nTeam. \n18) The vendor credits Lukhnos D. Liu, Lithoglyph Inc. \n26) Moritz Jodeit. \n27) The vendor credits Kevin Finisterre, DigitalMunition\n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=307179\n\nOTHER REFERENCES:\nSA19218:\nhttp://secunia.com/advisories/19218/\n\nSA24318:\nhttp://secunia.com/advisories/24318/\n\nSA25699:\nhttp://secunia.com/advisories/25699/\n\nSA26135:\nhttp://secunia.com/advisories/26135/\n\nSA26573:\nhttp://secunia.com/advisories/26573/\n\nSA26837:\nhttp://secunia.com/advisories/26837/\n\nSA26985:\nhttp://secunia.com/advisories/26985/\n\nSA27233:\nhttp://secunia.com/advisories/27233/\n\nSA27450:\nhttp://secunia.com/advisories/27450/\n\nSA27543:\nhttp://secunia.com/advisories/27543/\n\nSA27546:\nhttp://secunia.com/advisories/27546/\n\nSA27781:\nhttp://secunia.com/advisories/27781/\n\nSA27785:\nhttp://secunia.com/advisories/27785/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-3876"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "BID",
"id": "26926"
},
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "PACKETSTORM",
"id": "61917"
},
{
"db": "PACKETSTORM",
"id": "61950"
},
{
"db": "PACKETSTORM",
"id": "61915"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-27238",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-3876",
"trust": 2.9
},
{
"db": "BID",
"id": "26926",
"trust": 2.8
},
{
"db": "USCERT",
"id": "TA07-352A",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "28136",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1019106",
"trust": 2.5
},
{
"db": "BID",
"id": "26910",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2007-4238",
"trust": 1.7
},
{
"db": "EXPLOIT-DB",
"id": "4759",
"trust": 1.7
},
{
"db": "XF",
"id": "39109",
"trust": 1.4
},
{
"db": "USCERT",
"id": "SA07-352A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059",
"trust": 0.8
},
{
"db": "MILW0RM",
"id": "4759",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "11292\u203b11301",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "11292",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "11301",
"trust": 0.6
},
{
"db": "CERT/CC",
"id": "TA07-352A",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2007-12-17",
"trust": 0.6
},
{
"db": "IDEFENSE",
"id": "20071217 APPLE MAC OS X MOUNT_SMBFS STACK BASED BUFFER OVERFLOW VULNERABILITY",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "61917",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "61944",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-27238",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "61950",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "61915",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "BID",
"id": "26926"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "PACKETSTORM",
"id": "61917"
},
{
"db": "PACKETSTORM",
"id": "61950"
},
{
"db": "PACKETSTORM",
"id": "61915"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"id": "VAR-200712-0398",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:47:22.421000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security Update 2007-009",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=307179-en"
},
{
"title": "Security Update 2007-009",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=307179-ja"
},
{
"title": "TA07-352A",
"trust": 0.8,
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta07-352a.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/26926"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta07-352a.html"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1019106"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/28136"
},
{
"trust": 2.2,
"url": "http://docs.info.apple.com/article.html?artnum=307179"
},
{
"trust": 2.0,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=633"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2007/dec/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/26910"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2007/4238"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/39109"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/4759"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2007/4238"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39109"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-3876"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta07-352a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta07-352a/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-3876"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa07-352a.html"
},
{
"trust": 0.6,
"url": "http://www.milw0rm.com/exploits/4759"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/11292\u203b11301"
},
{
"trust": 0.3,
"url": "http://www.apple.com/macosx/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2007-3876"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "http://developer.apple.com/documentation/darwin/reference/manpages/man8/mount_smbfs.8.html"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "http://docs.info.apple.com/article.html?artnum=307179\u003e"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=apple-2007-009\u003e"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/\u003e"
},
{
"trust": 0.1,
"url": "http://docs.info.apple.com/article.html?artnum=106704\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/signup.html\u003e."
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/legal.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.us-cert.gov/cas/techalerts/ta07-352a.html\u003e"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate200700910411universal.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/28136/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26837/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/24318/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27785/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27543/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate20070091051.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26135/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26985/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27450/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27546/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27233/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27781/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/25699/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26573/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/19218/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate200700910411ppc.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/96/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "BID",
"id": "26926"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "PACKETSTORM",
"id": "61917"
},
{
"db": "PACKETSTORM",
"id": "61950"
},
{
"db": "PACKETSTORM",
"id": "61915"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-27238"
},
{
"db": "BID",
"id": "26926"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"db": "PACKETSTORM",
"id": "61917"
},
{
"db": "PACKETSTORM",
"id": "61950"
},
{
"db": "PACKETSTORM",
"id": "61915"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-12-19T00:00:00",
"db": "VULHUB",
"id": "VHN-27238"
},
{
"date": "2007-12-18T00:00:00",
"db": "BID",
"id": "26926"
},
{
"date": "2008-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"date": "2007-12-19T00:50:55",
"db": "PACKETSTORM",
"id": "61917"
},
{
"date": "2007-12-20T00:43:04",
"db": "PACKETSTORM",
"id": "61950"
},
{
"date": "2007-12-19T00:48:29",
"db": "PACKETSTORM",
"id": "61915"
},
{
"date": "2007-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"date": "2007-12-19T21:46:00",
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-29T00:00:00",
"db": "VULHUB",
"id": "VHN-27238"
},
{
"date": "2007-12-20T16:31:00",
"db": "BID",
"id": "26926"
},
{
"date": "2008-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001059"
},
{
"date": "2007-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200712-231"
},
{
"date": "2024-11-21T00:34:17.340000",
"db": "NVD",
"id": "CVE-2007-3876"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "26926"
},
{
"db": "PACKETSTORM",
"id": "61917"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
}
],
"trust": 1.0
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Mac OS X of SMB Multiple buffer overflow vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001059"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200712-231"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.