Lucene search

MitreCVE-2008-2330

HistorySep 16, 2008 - 11:00 p.m.

CVE-2008-2330

2008-09-1623:00:00

CWE-200

mitre

web.nvd.nist.gov

cve-2008-2330

apple

mac os x

directory services

slapconfig

openldap

security issue

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

5.3%

JSON

slapconfig in Directory Services in Apple Mac OS X 10.5 through 10.5.4 allows local users to select a readable output file into which the server password will be written by an OpenLDAP system administrator, related to the mkfifo function, aka an “insecure file operation issue.”

Affected configurations

Nvd

Node

applemac_os_x_serverMatch10.4.11

applemac_os_x_serverMatch10.5

applemac_os_x_serverMatch10.5.1

applemac_os_x_serverMatch10.5.2

applemac_os_x_serverMatch10.5.3

applemac_os_x_serverMatch10.5.4

VendorProductVersionCPE
applemac_os_x_server10.4.11cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
applemac_os_x_server10.5cpe:2.3:o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*
applemac_os_x_server10.5.1cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
applemac_os_x_server10.5.2cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
applemac_os_x_server10.5.3cpe:2.3:o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*
applemac_os_x_server10.5.4cpe:2.3:o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	mac_os_x_server	10.4.11	cpe:2.3:o:apple:mac_os_x_server:10.4.11:::::::*
apple	mac_os_x_server	10.5	cpe:2.3:o:apple:mac_os_x_server:10.5:::::::*
apple	mac_os_x_server	10.5.1	cpe:2.3:o:apple:mac_os_x_server:10.5.1:::::::*
apple	mac_os_x_server	10.5.2	cpe:2.3:o:apple:mac_os_x_server:10.5.2:::::::*
apple	mac_os_x_server	10.5.3	cpe:2.3:o:apple:mac_os_x_server:10.5.3:::::::*
apple	mac_os_x_server	10.5.4	cpe:2.3:o:apple:mac_os_x_server:10.5.4:::::::*

References

lists.apple.com/archives/security-announce//2008/Sep/msg00005.html

secunia.com/advisories/31882

securitytracker.com/id?1020874

www.securityfocus.com/bid/31189

www.us-cert.gov/cas/techalerts/TA08-260A.html

www.vupen.com/english/advisories/2008/2584

exchange.xforce.ibmcloud.com/vulnerabilities/45164

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

5.3%

JSON

Related for CVE-2008-2330