Apple Mac OS X unknown CoreFoundation issue when handling environment variables
| macos-corefoundation-environment (16051) |  High Risk |
Description:
Apple Mac OS X could allow a local attacker to possibly gain elevated privileges on the system, caused by an unknown vulnerability in the CoreFoundation component when handling environment variables.
Consequences:
Gain Privileges
Remedy:
Apply the patch for this vulnerability, as listed in AppleCare Knowledge Base Document 61798. See References.
References:
- AppleCare Knowledge Base Document 61798: Apple Security Update 2004-05-03 .
- CIAC Information Bulletin O-138: Apple Mac OS X Jaguar and Panther Security Vulnerabilities.
- BID-10270: Apple Mac OS X CoreFoundation Unspecified Large Input Vulnerability
- BID-10271: Apple Mac OS X AppleFileServer Remote Buffer Overflow Vulnerability
- CVE-2004-0428: Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to the handling of an environment variable
- SA11539: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1010045: Apple CoreFoundation Environment Variable Flaw Has Unspecified Impact
Platforms Affected:
- Apple Mac OS X 10.2
- Apple Mac OS X 10.2.1
- Apple Mac OS X 10.2.2
- Apple Mac OS X 10.2.3
- Apple Mac OS X 10.2.4
- Apple Mac OS X 10.2.5
- Apple Mac OS X 10.2.6
- Apple Mac OS X 10.2.7
- Apple Mac OS X 10.2.8
- Apple Mac OS X 10.3
- Apple Mac OS X 10.3.1
- Apple Mac OS X 10.3.2
- Apple Mac OS X 10.3.3
- Apple Mac OS X Server 10.2
- Apple Mac OS X Server 10.2.1
- Apple Mac OS X Server 10.2.2
- Apple Mac OS X Server 10.2.3
- Apple Mac OS X Server 10.2.4
- Apple Mac OS X Server 10.2.5
- Apple Mac OS X Server 10.2.6
- Apple Mac OS X Server 10.2.7
- Apple Mac OS X Server 10.2.8
- Apple Mac OS X Server 10.3
- Apple Mac OS X Server 10.3.1
- Apple Mac OS X Server 10.3.2
- Apple Mac OS X Server 10.3.3
Reported:
May 03, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net