CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
EPSS
Percentile
26.1%
A vulnerability in Apple Mac OS X AFP server may allow an authenticated local user to access files or folders with the credentials of another user.
The AFP (Apple Filing Protocol) service allows Apple Mac OS clients to remotely access files from a server. In Apple’s Mac OS X Server, the AFP server supports automatic reconnection of file sharing after a network outage by storing reconnect keys locally. The storage of these reconnect keys is unprotected by appropriate file system permissions. As a result, it is possible for an authenticated local user to read the reconnect keys and use them to access files and folders on the server with the system credentials of another user.
A user may be able to view sensitive reconnect keys within an unprotected file and use those keys to gain access with the credentials of another user. Apple states that this issue only affects Apple Mac OS X Server.
Apply an update
Apple has addressed this issue in Security Update 2006-004.
168020
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: August 02, 2006 Updated: August 03, 2006
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see Apple Security Update 2006-004 for details on updates.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23168020 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to Apple Product Security for reporting this vulnerability.
This document was written by Katie Washok.
CVE IDs: | CVE-2006-3495 |
---|---|
Severity Metric: | 3.60 Date Public: |