var-200801-0014
Vulnerability from variot

Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through 10.5.1, allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted URL that triggers memory corruption in Safari. Apple Safari for iPhone and iPod Touch is prone to a remote code-execution vulnerability because it fails to adequately sanitize user-supplied input. An attacker may exploit this issue by enticing victims into viewing a maliciously crafted URI. Successfully exploiting this issue can allow attackers to crash the application or to execute arbitrary code in the context of the affected application. This issue affects iPhone v1.0 to v1.1.2 and iPod Touch v1.1 to v1.1.2. The iPod touch (also known as iTouch) is an MP4 player released by Apple, and the iPhone is a smartphone released by it. Remote attackers may use this vulnerability to control the user's system.

2) An error in the handling of emergency calls can be exploited to bypass the Passcode Lock feature and allows users with physical access to an iPhone to launch applications without the passcode.

For more information see vulnerability #21 in: SA28136

SOLUTION: Update to version 1.1.3 (downloadable and installable via iTunes).

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

I. Further details are available in the US-CERT Vulnerability Notes Database. These products include Samba and X11.

II. Impact

The impacts of these vulnerabilities vary.

III. These and other updates are available via Software Update or via Apple Downloads.

IV. Please send email to cert@cert.org with "TA08-043B Feedback VU#774345" in the subject.

For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.

Produced 2008 by US-CERT, a government organization.

Terms of use:

 <http://www.us-cert.gov/legal.html>

Revision History

February 12, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBR7HyXPRFkHkM87XOAQLgawf/WfBp5mjT+DZriprWRqe1HM4Z9SSe/5Dg jMgSlX1j/YJC7FgZfjJvriQ+yXeOnhwvKggfTbkJWej+0AeRbyIUFWD/ZTh2Qylp /1vBehJW9nhT2yMT65/gT/MnbArN11AILkfSGr4W6xLPMR2zq0HsrP2SxYlAVkSO PPlo0KhWWATcjHjJEacdmry4fR6iv6xA0gFjWN6i18VX5LSMOEyO3LpDt+Rk8fet r7Pwi/QEr/nipEEw8R8Jg9+LT8dqQL1t+yhTa5pV1rceuEb3Cz67paHAqRneldW9 SAl/TPznmYCCMHqyOfHdRBUVvOxI09OPjHYkf7ghv5e06LqbfVMZug== =qwP5 -----END PGP SIGNATURE----- .

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.

Download and test it today: https://psi.secunia.com/

Read more about this new version: https://psi.secunia.com/?page=changelog

TITLE: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

SECUNIA ADVISORY ID: SA28891

VERIFY ADVISORY: http://secunia.com/advisories/28891/

CRITICAL: Highly critical

IMPACT: Security Bypass, Exposure of system information, Privilege escalation, DoS, System access

WHERE:

From remote

OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/

DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities and weaknesses.

1) An unspecified error exists within Foundation in Safari's handling of URLs. This can be exploited to cause a memory corruption when a user is enticed to access a specially crafted URL.

Successful exploitation may allow execution of arbitrary code.

2) A weakness exists due to Launch Services allowing users to start uninstalled applications from a Time Machine Backup.

3) An error in the handling of file:// URLs in Mail can be exploited to execute arbitrary applications without warning when a user is enticed to click on a URL within a message.

4) An unspecified error exists within NFS when handling mbuf chains. This can be exploited to cause a memory corruption and allows a system shutdown and potential execution of arbitrary code.

5) The problem is that Parental Controls contacts www.apple.com when a site is unblocked and allows for detection of computers running Parental Controls.

6) A boundary error in Samba can be exploited by malicious people to compromise a vulnerable system.

For more information: SA27760

7) An input validation error exists in Terminal when processing URL schemes.

8) Multiple vulnerabilities in X11 X Font Server can be exploited by malicious, local users to gain escalated privileges.

For more information: SA27040

9) An error exists in X11, which causes certain settings ("Allow connections from network client") not to be applied.

SOLUTION: Update to Mac OS X 10.5.2 or apply Security Update 2008-001.

Security Update 2008-001 (PPC): http://www.apple.com/support/downloads/securityupdate2008001ppc.html

Security Update 2008-001 (Universal): http://www.apple.com/support/downloads/securityupdate2008001universal.html

Mac OS X 10.5.2 Combo Update: http://www.apple.com/support/downloads/macosx1052comboupdate.html

Mac OS X Server 10.5.2 Combo Update: http://www.apple.com/support/downloads/macosxserver1052comboupdate.html

PROVIDED AND/OR DISCOVERED BY: 2) The vendor credits Steven Fisher of Discovery Software Ltd. and Ian Coutier. 4) The vendor credits Oleg Drokin, Sun Microsystems. 5) The vendor credits Jesse Pearson. 6) Alin Rad Pop, Secunia Research. 7) The vendor credits Olli Leppanen of Digital Film Finland, and Brian Mastenbrook.

ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307430

OTHER REFERENCES: SA27040: http://secunia.com/advisories/27040/

SA27760: http://secunia.com/advisories/27760/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200801-0014",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "safari",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "*"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.5"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.5.1"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.5"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.5.1"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v1.0 to  v1.1.2 version"
      },
      {
        "model": "ipod touch",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v1.1 to  v1.1.2 version"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "10.5"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "10.5.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5"
      },
      {
        "model": "ipod touch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.2"
      },
      {
        "model": "ipod touch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.1"
      },
      {
        "model": "ipod touch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.2"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.1"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.0.2"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.0.1"
      },
      {
        "model": "iphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1"
      },
      {
        "model": "mac os server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5.2"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.5.2"
      },
      {
        "model": "ipod touch",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.3"
      },
      {
        "model": "iphone",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "1.1.3"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "27296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:apple:mac_os_x",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:apple:mac_os_x_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:apple:iphone",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:apple:ipod_touch",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2008-0035",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2008-0035",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-30160",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2008-0035",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2008-0035",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200801-210",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-30160",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2008-0035",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through 10.5.1, allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted URL that triggers memory corruption in Safari. Apple Safari for iPhone and iPod Touch is prone to a remote code-execution vulnerability because it fails to adequately sanitize user-supplied input. \nAn attacker may exploit this issue by enticing victims into viewing a maliciously crafted URI. \nSuccessfully exploiting this issue can allow attackers to crash the application or to execute arbitrary code in the context of the affected application. \nThis issue affects iPhone v1.0 to v1.1.2 and iPod Touch v1.1 to v1.1.2. The iPod touch (also known as iTouch) is an MP4 player released by Apple, and the iPhone is a smartphone released by it. Remote attackers may use this vulnerability to control the user\u0027s system. \n\n2) An error in the handling of emergency calls can be exploited to\nbypass the Passcode Lock feature and allows users with physical\naccess to an iPhone to launch applications without the passcode. \n\nFor more information see vulnerability #21 in:\nSA28136\n\nSOLUTION:\nUpdate to version 1.1.3 (downloadable and installable via iTunes). \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\n\nI. Further\n   details are available in the US-CERT Vulnerability Notes Database. These products include Samba\n   and X11. \n\n\nII. Impact\n\n   The impacts of these vulnerabilities vary. \n\n\nIII.  These and other updates are available via Software Update or\n   via Apple Downloads. \n\n\nIV. Please send\n   email to \u003ccert@cert.org\u003e with \"TA08-043B Feedback VU#774345\" in the\n   subject. \n ____________________________________________________________________\n\n   For instructions on subscribing to or unsubscribing from this\n   mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n   Produced 2008 by US-CERT, a government organization. \n\n   Terms of use:\n\n     \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\n\nRevision History\n\n   February 12, 2008: Initial release\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBR7HyXPRFkHkM87XOAQLgawf/WfBp5mjT+DZriprWRqe1HM4Z9SSe/5Dg\njMgSlX1j/YJC7FgZfjJvriQ+yXeOnhwvKggfTbkJWej+0AeRbyIUFWD/ZTh2Qylp\n/1vBehJW9nhT2yMT65/gT/MnbArN11AILkfSGr4W6xLPMR2zq0HsrP2SxYlAVkSO\nPPlo0KhWWATcjHjJEacdmry4fR6iv6xA0gFjWN6i18VX5LSMOEyO3LpDt+Rk8fet\nr7Pwi/QEr/nipEEw8R8Jg9+LT8dqQL1t+yhTa5pV1rceuEb3Cz67paHAqRneldW9\nSAl/TPznmYCCMHqyOfHdRBUVvOxI09OPjHYkf7ghv5e06LqbfVMZug==\n=qwP5\n-----END PGP SIGNATURE-----\n. \n\n----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nApple Mac OS X Security Update Fixes Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA28891\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/28891/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Exposure of system information, Privilege\nescalation, DoS, System access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple Macintosh OS X\nhttp://secunia.com/product/96/\n\nDESCRIPTION:\nApple has issued a security update for Mac OS X, which fixes multiple\nvulnerabilities and weaknesses. \n\n1) An unspecified error exists within Foundation in Safari\u0027s handling\nof URLs. This can be exploited to cause a memory corruption when a\nuser is enticed to access a specially crafted URL. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n2) A weakness exists due to Launch Services allowing users to start\nuninstalled applications from a Time Machine Backup. \n\n3) An error in the handling of file:// URLs in Mail can be exploited\nto execute arbitrary applications without warning when a user is\nenticed to click on a URL within a message. \n\n4) An unspecified error exists within NFS when handling mbuf chains. \nThis can be exploited to cause a memory     corruption and allows a\nsystem shutdown and potential execution of arbitrary code. \n\n5) The problem is that Parental Controls contacts www.apple.com when\na site is unblocked and allows for detection of computers running\nParental Controls. \n\n6) A boundary error in Samba can be exploited by malicious people to\ncompromise a vulnerable system. \n\nFor more information:\nSA27760\n\n7) An input validation error exists in Terminal when processing URL\nschemes. \n\n8) Multiple vulnerabilities in X11 X Font Server can be exploited by\nmalicious, local users to gain escalated privileges. \n\nFor more information:\nSA27040\n\n9) An error exists in X11, which causes certain settings (\"Allow\nconnections from network client\") not to be applied. \n\nSOLUTION:\nUpdate to Mac OS X 10.5.2 or apply Security Update 2008-001. \n\nSecurity Update 2008-001 (PPC):\nhttp://www.apple.com/support/downloads/securityupdate2008001ppc.html\n\nSecurity Update 2008-001 (Universal):\nhttp://www.apple.com/support/downloads/securityupdate2008001universal.html\n\nMac OS X 10.5.2 Combo Update:\nhttp://www.apple.com/support/downloads/macosx1052comboupdate.html\n\nMac OS X Server 10.5.2 Combo Update:\nhttp://www.apple.com/support/downloads/macosxserver1052comboupdate.html\n\nPROVIDED AND/OR DISCOVERED BY:\n2) The vendor credits Steven Fisher of Discovery Software Ltd. and\nIan Coutier. \n4) The vendor credits Oleg Drokin, Sun Microsystems. \n5) The vendor credits Jesse Pearson. \n6) Alin Rad Pop, Secunia Research. \n7) The vendor credits Olli Leppanen of Digital Film Finland, and\nBrian Mastenbrook. \n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=307430\n\nOTHER REFERENCES:\nSA27040:\nhttp://secunia.com/advisories/27040/\n\nSA27760:\nhttp://secunia.com/advisories/27760/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "BID",
        "id": "27296"
      },
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "db": "PACKETSTORM",
        "id": "62684"
      },
      {
        "db": "PACKETSTORM",
        "id": "63540"
      },
      {
        "db": "PACKETSTORM",
        "id": "63584"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2008-0035",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "27296",
        "trust": 2.9
      },
      {
        "db": "SECUNIA",
        "id": "28497",
        "trust": 2.7
      },
      {
        "db": "USCERT",
        "id": "TA08-043B",
        "trust": 2.7
      },
      {
        "db": "SECTRACK",
        "id": "1019220",
        "trust": 2.5
      },
      {
        "db": "SECUNIA",
        "id": "28891",
        "trust": 1.9
      },
      {
        "db": "VUPEN",
        "id": "ADV-2008-0147",
        "trust": 1.7
      },
      {
        "db": "VUPEN",
        "id": "ADV-2008-0495",
        "trust": 1.7
      },
      {
        "db": "XF",
        "id": "39700",
        "trust": 0.8
      },
      {
        "db": "USCERT",
        "id": "SA08-043B",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-30160",
        "trust": 0.1
      },
      {
        "db": "VUPEN",
        "id": "2008/0495",
        "trust": 0.1
      },
      {
        "db": "VUPEN",
        "id": "2008/0147",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "62684",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "63540",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "63584",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "db": "BID",
        "id": "27296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "PACKETSTORM",
        "id": "62684"
      },
      {
        "db": "PACKETSTORM",
        "id": "63540"
      },
      {
        "db": "PACKETSTORM",
        "id": "63584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "id": "VAR-200801-0014",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T19:43:21.072000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Security Update 2008-001",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307430-en"
      },
      {
        "title": "iPhone v1.1.3 and iPod touch v1.1.3",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307302-en"
      },
      {
        "title": "iPhone v1.1.3 and iPod touch v1.1.3",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307302-ja"
      },
      {
        "title": "Security Update 2008-001",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307430-ja"
      },
      {
        "title": "TA08-043B",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta08-043b.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-399",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://www.securityfocus.com/bid/27296"
      },
      {
        "trust": 2.6,
        "url": "http://www.us-cert.gov/cas/techalerts/ta08-043b.html"
      },
      {
        "trust": 2.6,
        "url": "http://www.securitytracker.com/id?1019220"
      },
      {
        "trust": 2.6,
        "url": "http://secunia.com/advisories/28497"
      },
      {
        "trust": 2.2,
        "url": "http://docs.info.apple.com/article.html?artnum=307302"
      },
      {
        "trust": 2.2,
        "url": "http://docs.info.apple.com/article.html?artnum=307430"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2008/jan/msg00000.html"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2008/feb/msg00002.html"
      },
      {
        "trust": 1.8,
        "url": "http://secunia.com/advisories/28891"
      },
      {
        "trust": 1.8,
        "url": "http://www.vupen.com/english/advisories/2008/0147"
      },
      {
        "trust": 1.8,
        "url": "http://www.vupen.com/english/advisories/2008/0495/references"
      },
      {
        "trust": 1.8,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39700"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0035"
      },
      {
        "trust": 0.8,
        "url": "http://www.frsirt.com/english/advisories/2008/0147"
      },
      {
        "trust": 0.8,
        "url": "http://xforce.iss.net/xforce/xfdb/39700"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnta08-043b/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/tr/trta08-043b/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0035"
      },
      {
        "trust": 0.8,
        "url": "http://www.us-cert.gov/cas/alerts/sa08-043b.html"
      },
      {
        "trust": 0.3,
        "url": "http://software.cisco.com/download/navigator.html?mdfid=283613663"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/iphone/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.2,
        "url": "https://psi.secunia.com/?page=changelog"
      },
      {
        "trust": 0.2,
        "url": "https://psi.secunia.com/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/399.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/15128/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/28497/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/28136/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/16074/"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=307109\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.samba.org/samba/history/security.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/techalerts/ta08-043b.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.x.org/wiki/development/security\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=307430\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=106704\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/signup.html\u003e."
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/legal.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=apple_security_update_2008_001\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosx1052comboupdate.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/27760/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/27040/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/securityupdate2008001universal.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/96/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/securityupdate2008001ppc.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/28891/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosxserver1052comboupdate.html"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "db": "BID",
        "id": "27296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "PACKETSTORM",
        "id": "62684"
      },
      {
        "db": "PACKETSTORM",
        "id": "63540"
      },
      {
        "db": "PACKETSTORM",
        "id": "63584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "db": "BID",
        "id": "27296"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "db": "PACKETSTORM",
        "id": "62684"
      },
      {
        "db": "PACKETSTORM",
        "id": "63540"
      },
      {
        "db": "PACKETSTORM",
        "id": "63584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2008-01-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "date": "2008-01-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "date": "2008-01-15T00:00:00",
        "db": "BID",
        "id": "27296"
      },
      {
        "date": "2008-01-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "date": "2008-01-17T04:45:41",
        "db": "PACKETSTORM",
        "id": "62684"
      },
      {
        "date": "2008-02-12T22:23:40",
        "db": "PACKETSTORM",
        "id": "63540"
      },
      {
        "date": "2008-02-13T21:32:17",
        "db": "PACKETSTORM",
        "id": "63584"
      },
      {
        "date": "2008-01-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "date": "2008-01-16T02:00:00",
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-08T00:00:00",
        "db": "VULHUB",
        "id": "VHN-30160"
      },
      {
        "date": "2017-08-08T00:00:00",
        "db": "VULMON",
        "id": "CVE-2008-0035"
      },
      {
        "date": "2008-02-12T00:06:00",
        "db": "BID",
        "id": "27296"
      },
      {
        "date": "2008-02-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      },
      {
        "date": "2022-08-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      },
      {
        "date": "2024-11-21T00:41:00.647000",
        "db": "NVD",
        "id": "CVE-2008-0035"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural  Apple Product of  Foundation Memory corruption vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2008-001033"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "resource management error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200801-210"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.