Design/Logic Flaw

2009-11-1019:30:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.1%

JSON

Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response.

CPENameOperatorVersion
mac_os_xeq10.5.8
mac_os_xeq10.4.3
mac_os_xeq10.2.5
mac_os_xeq10.2.7
mac_os_xeq10.0.2
mac_os_xeq10.2.8
mac_os_xeq10.2.1
mac_os_xeq10.5.6
mac_os_xeq10.3.1
mac_os_xeq10.3.5

Name	Operator	Version
mac_os_x	eq	10.5.8
mac_os_x	eq	10.4.3
mac_os_x	eq	10.2.5
mac_os_x	eq	10.2.7
mac_os_x	eq	10.0.2
mac_os_x	eq	10.2.8
mac_os_x	eq	10.2.1
mac_os_x	eq	10.5.6
mac_os_x	eq	10.3.1
mac_os_x	eq	10.3.5