shell
Mac OS X File Association Meta Data Shell Script Execution - Advisories - Secunia
Home
Corporate Website
Jobs
Mailing Lists
RSS
Blog New entry
Advertise
Software Inspectors
Scan Online
Personal (PSI)
Network (NSI 1.0)
Network (NSI 2.0) - Public Beta -
Solutions For
Security Professionals
Security Vendors
Free Solutions For
Open Communities
Journalists & Media
Secunia Advisories
Search
Historic Advisories
Listed By Product
Listed By Vendor
Statistics / Graphs
Secunia Research
Report Vulnerability
About Advisories
Virus Information
Chronological List
Last 10 Virus Alerts
About Virus Information
Secunia Customers
Customer Area
Mac OS X File Association Meta Data Shell Script Execution
Secunia Advisory:
SA18963
Release Date:
2006-02-21
Last Update:
2006-03-14
Critical:
Extremely critical
Impact:
System access
Where:
From remote
Solution Status:
Partial Fix
OS:Apple Macintosh OS XCVE reference:CVE-2006-0848 (Secunia mirror)
Description:Michael Lehn has discovered a vulnerability in Mac OS X, which can be exploited by malicious people to compromise a user's system.The vulnerability is caused due to an error in the processing of file association meta data in ZIP archives (stored in the "__MACOSX" folder) and mail messages (defined via the AppleDouble MIME format). This can be exploited to trick users into executing a malicious shell script renamed to a safe file extension stored in a ZIP archive or in a mail attachment.This can also be exploited automatically via the Safari browser when visiting a malicious web site.Secunia has constructed a test, which can be used to check if your system is affected by this issue:http://secunia.com/mac_os_x_command_execution_vulnerability_test/The vulnerability has been confirmed on a fully patched system with Safari 2.0.3 (417.8), Mail 2.0.5 (746/746.2), and Mac OS X 10.4.5.Solution:Apply Security Update 2006-002.NOTE: The update does not completely fix the vulnerability as it is still possible to trick users into opening malicious shell scripts (masqueraded as a safe file type) in ZIP archives. Do not open files in untrusted archives.Provided and/or discovered by:Michael LehnChangelog:2006-02-22: Added link to US-CERT vulnerability note, and updated "Description" and "Solution" sections.2006-02-27: Added CVE reference.2006-03-02: Updated "Solution" section.2006-03-03: Updated "Solution" section.2006-03-14: Vendor issues Security Update 2006-002. Updated "Solution" section.Other References:US-CERT VU#999708:http://www.kb.cert.org/vuls/id/999708
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
121 Related Secunia Security Advisories, displaying 10
1. Mac OS X Security Update Fixes Multiple Vulnerabilities
2. Apple Mac OS X "ipcomp6_input()" Denial of Service
3. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
4. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
5. Mac OS X Java Multiple Vulnerabilities
6. Mac OS X "cs_validate_page()" Local Denial of Service
7. Mac OS X vpnd Denial of Service Vulnerability
8. Mac OS X Local Denial of Service Vulnerability
9. Apple Mail Command Execution Vulnerability
10. Apple Mac OS X Application Firewall Weaknesses and Security Issue
Show all related advisories
Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
Secunia PSIScan | Patch | TrackFree Download
Secunia Poll
Do you think it's important to read Setup/User Guides for applications for use within your network?
Yes, I do it all the time
Yes, but I do it rarely
No
See Results
Most Popular Advisories
1.
Safari Address Bar URL Spoofing Security Issue
2.
HP Software Update HPeDiag ActiveX Control Insecure Methods and Buffer Overflow
3.
Trillian Display Name Processing Memory Corruption
4.
WordPress "cat" Directory Traversal Vulnerability
5.
LightNEasy Multiple Vulnerabilities
6.
Debian update for perl
7.
RedDot CMS "LngId" SQL Injection Vulnerability
8.
Debian update for phpmyadmin
9.
WordPress Spreadsheet Plugin "ss_id" SQL Injection Vulnerability
10.
Gentoo update for jrockit-jdk-bin
Vulnerability Management -
Terms & Conditions -
Copyright 2002-2008 Secunia -
Compliance -
Contact Secunia
разделы
ванна моечный
черный кофе
metrobond
зеркало багуа
градирня вентиляторные грд
цвет камуфлир
три цвета: красный
лак orly
подводный гидромассаж
лад
видеосъемка торжество
braas
предохранитель пкн
диагностический стенд
cad купить
госпиталь мэш
применение доломита
антенна
иностранный долг
sony ericsson k790i купить
корпоративный обслуживание
вино заказ
избавиться спам
анимация 3d график
фотопечать
профессиональный психолог
прамышленый альпинизм
краска ржавчина
телевизионный антенна
nokia 6021 купить
пбоюл
куллер 478
индустриальный монитор
плата видеозахвата
нужен фотограф
деловой костюм
купить чейнджер
вытяжка
агат кристи билет
редизайн кострома
пассажирский лифт
газонокосилка stiga
встраиваемый вытяжка
8800 gold edition
дихроичное зеркало
выборочный лак
кислород
танго кэш
электро лаборатория
флаг башня
слимент лифт
тройник
тренировка память
фирменый цвет
оповещение
холодильник оптом
генерация кислорода
проект электропроводка
пассажирский лифт
inerta краска
отпуск конец
ларсен центр
поставка тройник
фосфорицирующая краска
shell