VAR-200412-0902
Vulnerability from variot - Updated: 2026-04-10 22:41Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow. Apple Mac OS X Directory Service utilities use external programs insecurely, potentially allowing an attacker to execute arbitrary code. LibTIFF Library TIFFFetchStripThing() Perform memory allocation in functions CheckMalloc() An integer overflow vulnerability exists due to a flaw in the validation of the value passed to the function.LibTIFF Arbitrary code may be executed with the execution authority of the application that uses the library.
Want a new IT Security job?
Vacant positions at Secunia: http://secunia.com/secunia_vacancies/
TITLE: Mac OS X Security Update Fixes Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA15227
VERIFY ADVISORY: http://secunia.com/advisories/15227/
CRITICAL: Highly critical
IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, System access
WHERE:
From remote
OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/
DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes various vulnerabilities.
1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument.
NOTE: htdigest is by default only locally accessible and not setuid / setgid.
2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system.
For more information: SA13607
3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application.
4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run.
5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly.
6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services.
7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges.
8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files.
For more information: SA14188
9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code.
10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions.
11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text.
12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system.
For more information: SA12549
13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction.
14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system.
15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service.
16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges.
For more information: SA13199
17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles.
18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs.
19) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on systems configured as a VPN server.
SOLUTION: Apply Security Update 2005-005.
Security Update 2005-005 (Client): http://www.apple.com/support/downloads/securityupdate2005005client.html
Security Update 2005-005 (Server): http://www.apple.com/support/downloads/securityupdate2005005server.html
PROVIDED AND/OR DISCOVERED BY: 1) JxT 3) Henrik Dalgaard 4) David Remahl 5) Kevin Finisterre, digitalmunition.com. 6) Kevin Finisterre, digitalmunition.com. 10) David Remahl 13) Rob Griffiths 14) Nico 17) David Remahl 18) David Remahl 19) Pieter de Boer
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=301528
David Remahl: http://remahl.se/david/vuln/004/ http://remahl.se/david/vuln/010/ http://remahl.se/david/vuln/011/ http://remahl.se/david/vuln/012/
digitalmunition.com: http://www.digitalmunition.com/DMA[2005-0502a].txt
iDEFENSE: http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities
OTHER REFERENCES: SA12549: http://secunia.com/advisories/12549/
SA13199: http://secunia.com/advisories/13199/
SA13607: http://secunia.com/advisories/13607/
SA14188: http://secunia.com/advisories/14188/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": null,
"scope": null,
"trust": 2.4,
"vendor": "apple computer",
"version": null
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 1.6,
"vendor": "sun",
"version": "7.0"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 1.6,
"vendor": "sun",
"version": "10.0"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 1.6,
"vendor": "sun",
"version": "8.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.5"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.2"
},
{
"_id": null,
"model": "icontrol service manager",
"scope": "eq",
"trust": 1.0,
"vendor": "f5",
"version": "1.3.5"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.3"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 1.0,
"vendor": "sun",
"version": "9.0"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.1"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.2"
},
{
"_id": null,
"model": "mandrake linux corporate server",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "3.0"
},
{
"_id": null,
"model": "modular messaging message storage server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "1.1"
},
{
"_id": null,
"model": "modular messaging message storage server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "2.0"
},
{
"_id": null,
"model": "propack",
"scope": "eq",
"trust": 1.0,
"vendor": "sgi",
"version": "3.0"
},
{
"_id": null,
"model": "icontrol service manager",
"scope": "eq",
"trust": 1.0,
"vendor": "f5",
"version": "1.3"
},
{
"_id": null,
"model": "icontrol service manager",
"scope": "eq",
"trust": 1.0,
"vendor": "f5",
"version": "1.3.6"
},
{
"_id": null,
"model": "cvlan",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "*"
},
{
"_id": null,
"model": "call management system server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "8.0"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.6.0"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.3"
},
{
"_id": null,
"model": "sunos",
"scope": "eq",
"trust": 1.0,
"vendor": "sun",
"version": "5.7"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.6"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.2"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.8"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "gentoo",
"version": "*"
},
{
"_id": null,
"model": "unixware",
"scope": "eq",
"trust": 1.0,
"vendor": "sco",
"version": "7.1.4"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.6"
},
{
"_id": null,
"model": "call management system server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "9.0"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.8"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.1"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.4"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.7"
},
{
"_id": null,
"model": "call management system server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "11.0"
},
{
"_id": null,
"model": "call management system server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "13.0"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.7"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.9"
},
{
"_id": null,
"model": "call management system server",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "12.0"
},
{
"_id": null,
"model": "sunos",
"scope": "eq",
"trust": 1.0,
"vendor": "sun",
"version": "5.8"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.4"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.7"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.1"
},
{
"_id": null,
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "10.0"
},
{
"_id": null,
"model": "mn100",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "*"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.4"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "conectiva",
"version": "10.0"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.7.0"
},
{
"_id": null,
"model": "integrated management",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "*"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.9"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3"
},
{
"_id": null,
"model": "interactive response",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "*"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.5.5"
},
{
"_id": null,
"model": "interactive response",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "1.2.1"
},
{
"_id": null,
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "10.1"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "conectiva",
"version": "9.0"
},
{
"_id": null,
"model": "interactive response",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "1.3"
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.5"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.6.1"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.3"
},
{
"_id": null,
"model": "intuity audix lx",
"scope": "eq",
"trust": 1.0,
"vendor": "avaya",
"version": "*"
},
{
"_id": null,
"model": "icontrol service manager",
"scope": "eq",
"trust": 1.0,
"vendor": "f5",
"version": "1.3.4"
},
{
"_id": null,
"model": "libtiff",
"scope": "eq",
"trust": 1.0,
"vendor": "libtiff",
"version": "3.4"
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "red hat",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"_id": null,
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.3.9"
},
{
"_id": null,
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.3.9"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "10 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "10 (x86)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "7.0 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "7.0 (x86)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "8 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "8 (x86)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "9 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "9 (x86)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (as)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (es)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (ws)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (as)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (es)"
},
{
"_id": null,
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (ws)"
},
{
"_id": null,
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3.0"
},
{
"_id": null,
"model": "linux advanced workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
},
{
"db": "NVD",
"id": "CVE-2004-1307"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:sun:solaris",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:redhat:enterprise_linux",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:redhat:enterprise_linux_desktop",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:redhat:linux_advanced_workstation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
}
]
},
"credits": {
"_id": null,
"data": "Discovery credited to infamous41md[at]hotpop.com.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
}
],
"trust": 0.6
},
"cve": "CVE-2004-1307",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2004-1307",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-9737",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2004-1307",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#356070",
"trust": 0.8,
"value": "22.31"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#539110",
"trust": 0.8,
"value": "5.04"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#331694",
"trust": 0.8,
"value": "15.94"
},
{
"author": "NVD",
"id": "CVE-2004-1307",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200412-081",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-9737",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-9737"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
},
{
"db": "NVD",
"id": "CVE-2004-1307"
}
]
},
"description": {
"_id": null,
"data": "Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow. Apple Mac OS X Directory Service utilities use external programs insecurely, potentially allowing an attacker to execute arbitrary code. LibTIFF Library TIFFFetchStripThing() Perform memory allocation in functions CheckMalloc() An integer overflow vulnerability exists due to a flaw in the validation of the value passed to the function.LibTIFF Arbitrary code may be executed with the execution authority of the application that uses the library. \n\n----------------------------------------------------------------------\n\nWant a new IT Security job?\n\nVacant positions at Secunia:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nMac OS X Security Update Fixes Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA15227\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/15227/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Spoofing, Exposure of sensitive information,\nPrivilege escalation, System access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple Macintosh OS X\nhttp://secunia.com/product/96/\n\nDESCRIPTION:\nApple has issued a security update for Mac OS X, which fixes various\nvulnerabilities. \n\n1) A boundary error in htdigest can be exploited to cause a buffer\noverflow by passing an overly long realm argument. \n\nNOTE: htdigest is by default only locally accessible and not setuid /\nsetgid. \n\n2) An integer overflow error in the AppKit component when processing\nTIFF files can be exploited by malicious people to compromise a\nuser\u0027s system. \n\nFor more information:\nSA13607\n\n3) An error in the AppKit component when parsing certain TIFF images\ncan result in an invalid call to the \"NXSeek()\" function, which will\ncrash an affected Cocoa application. \n\n4) An error within the handling of AppleScript can be exploited to\ndisplay code to a user that is different than the code, which will\nactually run. \n\n5) An error in the Bluetooth support may cause Bluetooth-enabled\nsystems to share files via the Bluetooth file exchange service\nwithout notifying the user properly. \n\n6) An input validation error can be exploited to access arbitrary\nfiles on a Bluetooth-enabled system using directory traversal attacks\nvia the Bluetooth file and object exchange services. \n\n7) The chfn, chpass, and chsh utilities invoke certain external\nhelper programs insecurely, which can be exploited by malicious,\nlocal users to gain escalated privileges. \n\n8) A vulnerability in Finder can be exploited by malicious, local\nusers to perform certain actions on a vulnerable system with\nescalated privileges due to insecure creation of \".DS_Store\" files. \n\nFor more information:\nSA14188\n\n9) A boundary error within the Foundation framework when handling\nenvironment variables can be exploited to cause a buffer overflow and\nmay allow execution of arbitrary code. \n\n10) An error in Help Viewer can be exploited to run JavaScript\nwithout the normally imposed security restrictions. \n\n11) A security issue in the LDAP functionality may under certain\ncircumstances result in passwords initially being stored in plain\ntext. \n\n12) Errors within the parsing of XPM files can potentially be\nexploited by malicious people to compromise a vulnerable system. \n\nFor more information:\nSA12549\n\n13) An error in lukemftpd can be exploited by malicious users to\nbypass chroot restrictions. In order to restrict users to their home\ndirectory, both their full name and short name must be listed in the\n\"/etc/ftpchroot\" file. However, the problem is that users can change\ntheir full name and thereby bypass this restriction. \n\n14) A boundary error in the Netinfo Setup Tool (NeST) when processing\ninput passed to the \"-target\" command line parameter can be exploited\nby malicious, local users to cause a buffer overflow and execute\narbitrary code with escalated privileges on a vulnerable system. \n\n15) When enabling the HTTP proxy service in Server Admin, it is by\ndefault possible for everyone (including users on the Internet) to\nuse the proxy service. \n\n16) A vulnerability in sudo within the environment clearing can be\nexploited by malicious, local users to gain escalated privileges. \n\nFor more information:\nSA13199\n\n17) An error in the Terminal utility can be exploited to inject data\nvia malicious input containing escape sequences in window titles. \n\n18) An error in the Terminal utility can be exploited to inject\ncommands into a user\u0027s Terminal session via malicious input\ncontaining escape characters in x-man-path URIs. \n\n19) A boundary error in vpnd can be exploited by malicious, local\nusers to cause a buffer overflow and execute arbitrary code with\nescalated privileges on systems configured as a VPN server. \n\nSOLUTION:\nApply Security Update 2005-005. \n\nSecurity Update 2005-005 (Client):\nhttp://www.apple.com/support/downloads/securityupdate2005005client.html\n\nSecurity Update 2005-005 (Server):\nhttp://www.apple.com/support/downloads/securityupdate2005005server.html\n\nPROVIDED AND/OR DISCOVERED BY:\n1) JxT\n3) Henrik Dalgaard\n4) David Remahl\n5) Kevin Finisterre, digitalmunition.com. \n6) Kevin Finisterre, digitalmunition.com. \n10) David Remahl\n13) Rob Griffiths\n14) Nico\n17) David Remahl\n18) David Remahl\n19) Pieter de Boer\n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=301528\n\nDavid Remahl:\nhttp://remahl.se/david/vuln/004/\nhttp://remahl.se/david/vuln/010/\nhttp://remahl.se/david/vuln/011/\nhttp://remahl.se/david/vuln/012/\n\ndigitalmunition.com:\nhttp://www.digitalmunition.com/DMA[2005-0502a].txt\n\niDEFENSE:\nhttp://www.idefense.com/application/poi/display?id=239\u0026type=vulnerabilities\n\nOTHER REFERENCES:\nSA12549:\nhttp://secunia.com/advisories/12549/\n\nSA13199:\nhttp://secunia.com/advisories/13199/\n\nSA13607:\nhttp://secunia.com/advisories/13607/\n\nSA14188:\nhttp://secunia.com/advisories/14188/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-1307"
},
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
},
{
"db": "VULHUB",
"id": "VHN-9737"
},
{
"db": "PACKETSTORM",
"id": "37530"
}
],
"trust": 3.96
},
"external_ids": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#539110",
"trust": 3.3
},
{
"db": "SECUNIA",
"id": "15227",
"trust": 2.5
},
{
"db": "USCERT",
"id": "TA05-136A",
"trust": 2.5
},
{
"db": "NVD",
"id": "CVE-2004-1307",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "16084",
"trust": 0.8
},
{
"db": "BID",
"id": "13502",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#356070",
"trust": 0.8
},
{
"db": "SECTRACK",
"id": "1012651",
"trust": 0.8
},
{
"db": "SECUNIA",
"id": "13607",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "16075",
"trust": 0.8
},
{
"db": "XF",
"id": "20376",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "VU#331694",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081",
"trust": 0.7
},
{
"db": "CERT/CC",
"id": "TA05-136A",
"trust": 0.6
},
{
"db": "OVAL",
"id": "OVAL:ORG.MITRE.OVAL:DEF:11175",
"trust": 0.6
},
{
"db": "SUNALERT",
"id": "101677",
"trust": 0.6
},
{
"db": "SUNALERT",
"id": "201072",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2005-05-03",
"trust": 0.6
},
{
"db": "IDEFENSE",
"id": "20041221 LIBTIFF STRIPOFFSETS INTEGER OVERFLOW VULNERABILITY",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-9737",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "37530",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-9737"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
},
{
"db": "NVD",
"id": "CVE-2004-1307"
}
]
},
"id": "VAR-200412-0902",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-9737"
}
],
"trust": 0.01
},
"last_update_date": "2026-04-10T22:41:33.816000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Security Update 2005-005",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=301528"
},
{
"title": "Security Update 2005-005",
"trust": 0.8,
"url": "http://docs.info.apple.com/jarticle.html?artnum=301528"
},
{
"title": "RHSA-2004:577",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/RHSA-2004-577.html"
},
{
"title": "101677",
"trust": 0.8,
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1"
},
{
"title": "RHSA-2004:577",
"trust": 0.8,
"url": "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2004-577J.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-1307"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.5,
"url": "http://secunia.com/advisories/15227/"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta05-136a.html"
},
{
"trust": 2.5,
"url": "http://www.kb.cert.org/vuls/id/539110"
},
{
"trust": 1.7,
"url": "http://docs.info.apple.com/article.html?artnum=301528"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2005/may/msg00001.html"
},
{
"trust": 1.7,
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1"
},
{
"trust": 1.7,
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1"
},
{
"trust": 1.6,
"url": "http://www.idefense.com/application/poi/display?id=173\u0026type=vulnerabilities\u0026flashstatus=true"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11175"
},
{
"trust": 0.9,
"url": "http://remahl.se/david/vuln/011/"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/13607/"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/13502/"
},
{
"trust": 0.8,
"url": "http://www.osvdb.org/displayvuln.php?osvdb_id=16084"
},
{
"trust": 0.8,
"url": "http://securitytracker.com/alerts/2004/dec/1012651.html"
},
{
"trust": 0.8,
"url": "http://www.idefense.com/application/poi/display?id=173\u0026type=vulnerabilities"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/20376"
},
{
"trust": 0.8,
"url": "http://www.apple.com/server/macosx/"
},
{
"trust": 0.8,
"url": "http://www.osvdb.org/16075"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-1307"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/wr/2005/wr052001.txt"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta05-136a/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta05-136a/"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-1307"
},
{
"trust": 0.6,
"url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:11175"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/application/poi/display?id=173\u0026amp;type=vulnerabilities\u0026amp;flashstatus=true"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate2005005server.html"
},
{
"trust": 0.1,
"url": "http://www.digitalmunition.com/dma[2005-0502a].txt"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/010/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/012/"
},
{
"trust": 0.1,
"url": "http://remahl.se/david/vuln/004/"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/securityupdate2005005client.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/application/poi/display?id=239\u0026type=vulnerabilities"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/14188/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/12549/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/96/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/13199/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
},
{
"db": "CERT/CC",
"id": "VU#539110"
},
{
"db": "CERT/CC",
"id": "VU#331694"
},
{
"db": "VULHUB",
"id": "VHN-9737"
},
{
"db": "PACKETSTORM",
"id": "37530"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574"
},
{
"db": "NVD",
"id": "CVE-2004-1307"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#356070",
"ident": null
},
{
"db": "CERT/CC",
"id": "VU#539110",
"ident": null
},
{
"db": "CERT/CC",
"id": "VU#331694",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-9737",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "37530",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-200412-081",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000574",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2004-1307",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2005-05-06T00:00:00",
"db": "CERT/CC",
"id": "VU#356070",
"ident": null
},
{
"date": "2005-01-20T00:00:00",
"db": "CERT/CC",
"id": "VU#539110",
"ident": null
},
{
"date": "2005-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#331694",
"ident": null
},
{
"date": "2004-12-21T00:00:00",
"db": "VULHUB",
"id": "VHN-9737",
"ident": null
},
{
"date": "2005-05-29T20:22:44",
"db": "PACKETSTORM",
"id": "37530",
"ident": null
},
{
"date": "2004-12-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-081",
"ident": null
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000574",
"ident": null
},
{
"date": "2004-12-21T05:00:00",
"db": "NVD",
"id": "CVE-2004-1307",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2005-05-16T00:00:00",
"db": "CERT/CC",
"id": "VU#356070",
"ident": null
},
{
"date": "2005-08-23T00:00:00",
"db": "CERT/CC",
"id": "VU#539110",
"ident": null
},
{
"date": "2005-05-25T00:00:00",
"db": "CERT/CC",
"id": "VU#331694",
"ident": null
},
{
"date": "2018-10-30T00:00:00",
"db": "VULHUB",
"id": "VHN-9737",
"ident": null
},
{
"date": "2009-02-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-081",
"ident": null
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000574",
"ident": null
},
{
"date": "2025-04-03T01:03:51.193000",
"db": "NVD",
"id": "CVE-2004-1307",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Apple Terminal fails to properly sanitize input for \"x-man-page\" URI",
"sources": [
{
"db": "CERT/CC",
"id": "VU#356070"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-081"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…