CVE-2007-5863
published 2007-12-19CVE-2007-5863: Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the…
PriorityP355critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
22.98%
97.8th percentile
Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server, using a modified distribution definition file with the "allow-external-scripts" option.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect MITM abuse of Apple Software Update by monitoring for HTTP responses to swscan.apple.com that contain the 'allow-external-scripts' option in a distribution definition (.dist) file. ↗
- →Alert on .sucatalog HTTP responses that reference an unexpected or non-Apple server hostname in the distribution URL entries, as the exploit substitutes a malicious server for swscan.apple.com. ↗
- →Monitor for .dist files served over HTTP (port 80, unencrypted) to Apple Software Update clients; legitimate Apple updates are served over HTTPS. A .dist file containing JavaScript with system command execution (e.g., via 'system.run()') is a strong indicator of exploitation. ↗
- →Inspect HTTP responses for Content-Type 'text/plain' delivering .sucatalog or .dist payloads on port 80 from non-Apple infrastructure, consistent with the exploit's server emulation. ↗
- →Look for .dist distribution scripts containing a randomly named JavaScript function that invokes shell commands via payload types: generic, perl, ruby, bash, telnet. ↗
- ·The exploit requires the attacker to already redirect victim traffic to the malicious server (e.g., via ARP poisoning or DNS spoofing); the module itself only provides the malicious update server. ↗
- ·The product key embedded in the malicious .sucatalog is randomly generated (3 digits + '-' + 4 digits), so static string matching on the product key is not reliable for detection. ↗
- ·The .dist filename is randomly generated (8 random alpha characters), so filename-based detection must use the .dist extension pattern rather than a fixed name. ↗
- ·The JavaScript function name within the .dist payload is also randomly generated, preventing static signature matching on the function name alone. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Apple Mac OSX Software Update - Command Execution (Metasploit)
exploitdb·2010-09-20
CVE-2007-5863 Apple Mac OSX Software Update - Command Execution (Metasploit)
Apple Mac OSX Software Update - Command Execution (Metasploit)
---
##
# $Id: software_update.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Apple OS X Software Update Command Execution',
'Description' => %q{
This module exploits a feature in the Distribution Packages,
which are used in the Apple Software Update mechanism. This feature
allows for arbitrary command execution through JavaScript. This exploit
provides the malicious update server. Requests must be redirected to
this server by other means fo
Metasploit
Apple OS X Software Update Command Execution
metasploit
Apple OS X Software Update Command Execution
Apple OS X Software Update Command Execution
This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means for this exploit to work.
No writeups or analysis indexed.
http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/28136http://securitytracker.com/id?1019106http://www.securityfocus.com/archive/1/485237/100/0/threadedhttp://www.securityfocus.com/bid/26908http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/4238https://exchange.xforce.ibmcloud.com/vulnerabilities/39111http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/28136http://securitytracker.com/id?1019106http://www.securityfocus.com/archive/1/485237/100/0/threadedhttp://www.securityfocus.com/bid/26908http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/4238https://exchange.xforce.ibmcloud.com/vulnerabilities/39111
2007-12-19
Published