CVE-2008-4212
published 2008-10-10CVE-2008-4212: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in…
PriorityP342critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
2.59%
83.7th percentile
Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
| apple | mac_os_x_server | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2008-4212: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10
vendor_redhat·CVSS 10.0
CVE-2008-4212 [CRITICAL] CVE-2008-4212: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10
Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.
Statement: Not vulnerable. This issue did not affect the versions of rsh-server packages as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
The glibcs ruserok function is used to check users authorization against rhosts files. That implementation of ruserok never opens /etc/hosts.equiv for superuser.
GHSA
GHSA-vq9m-ghf7-f8ph: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10
ghsa_unreviewed·2022-05-02
CVE-2008-4212 [HIGH] GHSA-vq9m-ghf7-f8ph: Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10
Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://secunia.com/advisories/32222http://support.apple.com/kb/HT3216http://www.securityfocus.com/bid/31681http://www.securityfocus.com/bid/31708http://www.securitytracker.com/id?1021028http://www.vupen.com/english/advisories/2008/2780https://exchange.xforce.ibmcloud.com/vulnerabilities/45785http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://secunia.com/advisories/32222http://support.apple.com/kb/HT3216http://www.securityfocus.com/bid/31681http://www.securityfocus.com/bid/31708http://www.securitytracker.com/id?1021028http://www.vupen.com/english/advisories/2008/2780https://exchange.xforce.ibmcloud.com/vulnerabilities/45785
2008-10-10
Published