Apple Mac OS X file sharing allows authenticated remote access to files and directories

Overview

Apple Mac OS X Leopard does not accurately reflect which files and directories are available via sharing.

Description

Apple Mac OS X Leopard (10.5.x) allows files and directories to be shared via a “Shared Folders” feature. OS X lists the folders that are shared using this feature, however the list is incomplete. An authenticated user can access his home directory remotely, and an authenticated administrator can remotely access the entire hard drive.

---

Impact

A system that is configured with Shared Folders enabled may be exposing more files and directories than expected.

---

Solution

Apply an update

This issue is addressed in Apple Mac OS X 10.5.5. This update causes OS X to more accurately explain which files and directories are shared. Please see the Apple Advisory for more details.

---

Vendor Information

126787

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Apple Computer, Inc. __ Affected

Notified: December 13, 2007 Updated: September 15, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

This issue is addressed in Apple Mac OS X 10.5.5. This update causes OS X to more accurately explain which files and directories are shared. Please see the Apple Advisory for more details.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23126787 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

<http://support.apple.com/kb/HT3137&gt;

Acknowledgements

Thanks to Russ Andersson for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2008-3618
Severity Metric:	1.01 Date Public: