CVE-2007-5863
published 2007-12-19CVE-2007-5863: Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the…
critical9.3CVSS 3.1
AVNACMAuNCCICAC
EXPLOIT
Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server, using a modified distribution definition file with the "allow-external-scripts" option.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
No detection rules found.
Exploit-DB
Apple Mac OSX Software Update - Command Execution (Metasploit)
exploitdb·2010-09-20
CVE-2007-5863 Apple Mac OSX Software Update - Command Execution (Metasploit)
Apple Mac OSX Software Update - Command Execution (Metasploit)
---
##
# $Id: software_update.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Apple OS X Software Update Command Execution',
'Description' => %q{
This module exploits a feature in the Distribution Packages,
which are used in the Apple Software Update mechanism. This feature
allows for arbitrary command execution through JavaScript. This exploit
provides the malicious update server. Requests must be redirected to
this server by other means fo
Metasploit
Apple OS X Software Update Command Execution
metasploit
Apple OS X Software Update Command Execution
Apple OS X Software Update Command Execution
This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means for this exploit to work.
No writeups or analysis indexed.
http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/28136http://securitytracker.com/id?1019106http://www.securityfocus.com/archive/1/485237/100/0/threadedhttp://www.securityfocus.com/bid/26908http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/4238https://exchange.xforce.ibmcloud.com/vulnerabilities/39111http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/28136http://securitytracker.com/id?1019106http://www.securityfocus.com/archive/1/485237/100/0/threadedhttp://www.securityfocus.com/bid/26908http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/4238https://exchange.xforce.ibmcloud.com/vulnerabilities/39111
2007-12-19
Published