CVE-2006-5327
published 2006-10-17CVE-2006-5327: Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local…
PriorityP426high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.60%
48.2th percentile
Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | <= 2.2 | — |
| openbase_international_ltd | openbase | <= 10.0 | — |
| openbase_international_ltd | openbase | — | — |
| openbase_international_ltd | openbase | — | — |
| openbase_international_ltd | openbase | — | — |
| openbase_international_ltd | openbase | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w3q8-f3hm-869w: Untrusted search path vulnerability in OpenBase SQL 10
ghsa_unreviewed·2022-05-01
CVE-2006-5327 [HIGH] GHSA-w3q8-f3hm-869w: Untrusted search path vulnerability in OpenBase SQL 10
Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.
GHSA
GHSA-3w4m-x79g-ghg6: Untrusted search path vulnerability in openexec in OpenBase SQL before 10
ghsa_unreviewed·2022-05-01·CVSS 7.2
CVE-2006-5852 [HIGH] GHSA-3w4m-x79g-ghg6: Untrusted search path vulnerability in openexec in OpenBase SQL before 10
Untrusted search path vulnerability in openexec in OpenBase SQL before 10.0.1 allows local users to gain privileges via a modified PATH that references a malicious helper binary, as demonstrated by (1) cp, (2) rm, and (3) killall, different vectors than CVE-2006-5327.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.htmlhttp://secunia.com/advisories/22390http://secunia.com/advisories/22474http://secunia.com/advisories/27441http://www.digitalmunition.com/DMA%5B2006-1016a%5D.txthttp://www.digitalmunition.com/Xcode_OpenBase_pwn.plhttp://www.securityfocus.com/bid/20562http://www.securitytracker.com/id?1018872http://www.vupen.com/english/advisories/2006/4058http://www.vupen.com/english/advisories/2006/4059http://www.vupen.com/english/advisories/2007/3665https://exchange.xforce.ibmcloud.com/vulnerabilities/29624http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.htmlhttp://secunia.com/advisories/22390http://secunia.com/advisories/22474http://secunia.com/advisories/27441http://www.digitalmunition.com/DMA%5B2006-1016a%5D.txthttp://www.digitalmunition.com/Xcode_OpenBase_pwn.plhttp://www.securityfocus.com/bid/20562http://www.securitytracker.com/id?1018872http://www.vupen.com/english/advisories/2006/4058http://www.vupen.com/english/advisories/2006/4059http://www.vupen.com/english/advisories/2007/3665https://exchange.xforce.ibmcloud.com/vulnerabilities/29624
2006-10-17
Published