Info

Disclosure

May 03, 2005

Discovery

Feb 21, 2005

Dates

Exploit

May 03, 2005

Solution

Unknown

Description

Mac OS X contains a flaw that may allow a malicious user to execute arbitrary commands. The issue is triggered when x-man-path escape sequences are used to inject arbitrary commands into the Terminal program. It is possible that the flaw may allow arbitrary command execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch to address this vulnerability.

Products

Apple Computer, Inc.	Mac OS X	10.3
		10.3.1
		10.3.2
		10.3.3
		10.3.4
		10.3.5
		10.3.6
		10.3.7
		10.3.8
		10.3.9

References

Security Tracker: 1013880
Bugtraq ID: 13480
Secunia Advisory ID: 15227
CVE ID: 2005-1342 (see also: NVD)
Mail List Post: http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0035.html
Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=301528
Other Advisory URL: http://remahl.se/david/vuln/011/
Vendor URL: http://www.apple.com/

Credit

David Remahl - davidremahl.se -

Direct URL: http://osvdb.org/16084

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Apple Computer, Inc.

Mac OS X

References

Credit