CVE-2010-0105
published 2010-04-27CVE-2010-0105: The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested…
PriorityP417medium4.9CVSS 2.0
AVLACLAuNCNINAC
EXPLOIT
EPSS
0.84%
53.2th percentile
The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested directory structures, which allows local users to cause a denial of service (filesystem corruption) via a crafted application that calls the mkdir and link functions, related to the fsck_hfs program in the diskdev_cmds component.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| msrc | microsoft_office_2010_service_pack_2 | — | — |
| msrc | microsoft_office_compatibility_pack_service_pack_3 | — | — |
| msrc | microsoft_office_web_apps_server_2010_service_pack_2 | — | — |
| msrc | microsoft_word_2007_service_pack_3 | — | — |
| msrc | microsoft_word_2010_service_pack_2 | — | — |
| msrc | microsoft_word_for_mac_2011 | — | — |
| msrc | word_automation_services_on_microsoft_sharepoint_server_2010_service_pack_2 | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
vendor_redhat6.5MEDIUM
vendor_msrc5.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wghh-9cwm-cgm9: Apple Mac OS X 10
ghsa_unreviewed·2022-05-17·CVSS 4.9
CVE-2013-6799 [MEDIUM] CWE-119 GHSA-wghh-9cwm-cgm9: Apple Mac OS X 10
Apple Mac OS X 10.9 allows local users to cause a denial of service (memory corruption or panic) by creating a hard link to a directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0105.
GHSA
GHSA-m3r9-2fp3-p448: The hfs implementation in Apple Mac OS X 10
ghsa_unreviewed·2022-05-02
CVE-2010-0105 [MEDIUM] GHSA-m3r9-2fp3-p448: The hfs implementation in Apple Mac OS X 10
The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested directory structures, which allows local users to cause a denial of service (filesystem corruption) via a crafted application that calls the mkdir and link functions, related to the fsck_hfs program in the diskdev_cmds component.
Microsoft
Microsoft Office Information Disclosure Vulnerability
vendor_msrc·2017-03-14·CVSS 5.5
CVE-2017-0105 [MEDIUM] Microsoft Office Information Disclosure Vulnerability
Microsoft Office Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerability could view out of bound memory.
Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.
The security update addresses the vulnerability by properly initializing the affected variable.
FAQ: I have Microsoft Word 2010 installed. Why am I not being offered the 3178686 update?
The 3178686 update only applies to systems running specific configurations of Microsoft Office 2010. Some configurations will not be
Red Hat
cacti: multiple command injection flaws (BONSAI-2010-0105)
vendor_redhat·2010-05-20·CVSS 6.5
CVE-2010-1645 [MEDIUM] cacti: multiple command injection flaws (BONSAI-2010-0105)
cacti: multiple command injection flaws (BONSAI-2010-0105)
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.
Red Hat
CVE-2010-0105: The hfs implementation in Apple Mac OS X 10
vendor_redhat·CVSS 4.9
CVE-2010-0105 [MEDIUM] CVE-2010-0105: The hfs implementation in Apple Mac OS X 10
The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested directory structures, which allows local users to cause a denial of service (filesystem corruption) via a crafted application that calls the mkdir and link functions, related to the fsck_hfs program in the diskdev_cmds component.
Statement: Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.
Red Hat
CVE-2013-6799: Apple Mac OS X 10
vendor_redhat·CVSS 4.9
CVE-2013-6799 [MEDIUM] CVE-2013-6799: Apple Mac OS X 10
Apple Mac OS X 10.9 allows local users to cause a denial of service (memory corruption or panic) by creating a hard link to a directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0105.
Statement: Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.
No detection rules found.
Exploit-DB
Apple Mac OSX 10.11 - FTS Deep Structure of the FileSystem Buffer Overflow
exploitdb·2015-12-09
CVE-2015-7039 Apple Mac OSX 10.11 - FTS Deep Structure of the FileSystem Buffer Overflow
Apple Mac OSX 10.11 - FTS Deep Structure of the FileSystem Buffer Overflow
---
MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow
Credit: Maksymilian Arciemowicz ( CXSECURITY )
Website:
http://cxsecurity.com/
http://cert.cx/
Affected software:
- MACOS's Commands such as: ls, find, rm
- iPhone 4s and later,
- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch Hermes
- Apple TV (4th generation)
- probably more
Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting.
PoC:
Create an direcotry and perform the following actions:
# for i in {1..1024}; do mkdir B && cd B; done
...
cd: error retrievi
Exploit-DB
Apple Mac OSX 10.9 - Hard Link Memory Corruption
exploitdb·2014-04-08·CVSS 4.9
CVE-2013-6799 [MEDIUM] Apple Mac OSX 10.9 - Hard Link Memory Corruption
Apple Mac OSX 10.9 - Hard Link Memory Corruption
---
/*
MacOSX/XNU HFS Multiple Vulnerabilities
Maksymilian Arciemowicz
http://cxsecurity.com/
http://cifrex.org/
On November 8th, I've reported vulnerability in hard links for HFS+
(CVE-2013-6799)
http://cxsecurity.com/issue/WLB-2013110059
The HFS+ file system does not apply strict privilege rules during the
creating of hard links. The ability to create hard links to directories is
wrong implemented and such an issue is affecting os versions greater or
equal to 10.5. Officially Apple allows you to create hard links only for
your time machine. Vulnerability CVE-2013-6799 (incomplete fix
for CVE-2010-0105) allow to create hard link to directory and the number of
hard links may be freely high. To create N hard links, you must use a
specia
Exploit-DB
Apple Mac OSX 10.6 - HFS FileSystem (Denial of Service)
exploitdb·2010-04-24·CVSS 4.9
CVE-2010-0105 [MEDIUM] Apple Mac OSX 10.6 - HFS FileSystem (Denial of Service)
Apple Mac OSX 10.6 - HFS FileSystem (Denial of Service)
---
// -----BEGIN PGP SIGNED MESSAGE-----
// Hash: SHA1
/* Proof of Concept for CVE-2010-0105
MacOS X 10.6 hfs file system attack (Denial of Service)
by Maksymilian Arciemowicz from SecurityReason.com
http://securityreason.com/achievement_exploitalert/15
NOTE:
This DoS will be localized in phase
Checking multi-linked directories
So we need activate it with line
connlink("C/C","CX");
Now we need create PATH_MAX/2 directory tree to make overflow.
and we should get diskutil and fsck_hfs exit with sig=8
~ x$ diskutil verifyVolume /Volumes/max2
Started filesystem verification on disk0s3 max2
Performing live verification
Checking Journaled HFS Plus volume
Checking extents overflow file
Checking catalog file
Checking multi-linked
Bugzilla
CVE-2010-1645 cacti: multiple command injection flaws (BONSAI-2010-0105)
bugzilla·2010-06-29·CVSS 6.5
CVE-2010-1645 [MEDIUM] CVE-2010-1645 cacti: multiple command injection flaws (BONSAI-2010-0105)
CVE-2010-1645 cacti: multiple command injection flaws (BONSAI-2010-0105)
Multiple input sanitization flaws were discovered in cacti. Authenticated cacti administrator could use these flaws to run shell commands with web server privileges.
Note: cacti administrator is always allowed to run commands as cacti user.
References:
http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
http://www.cacti.net/release_notes_0_8_7f.php
Upstream commits:
http://svn.cacti.net/viewvc?view=rev&revision=5778
http://svn.cacti.net/viewvc?view=rev&revision=5782
http://svn.cacti.net/viewvc?view=rev&revision=5784
See also bug #595289 for some related discussion.
Discussion:
*** Bug 586064 has been marked as a duplicate of this bug. ***
---
This issue has been addressed
Bugzilla
CVE kernel non-issue statements
bugzilla·2010-05-13·CVSS 5.0
[MEDIUM] CVE kernel non-issue statements
CVE kernel non-issue statements
This bug is to collect statements for Linux kernel-related CVE's that do not have their own top-level CVE SRT bug because it did not affect any of our supported kernels. These statements were also referred to as NVD statements and are noted on the NVD web site.
(From bug 589808) Do not change the bug alias, it needs to have "CVE" in the title. You can add extra statements in new comments or editing existing comments and they will be picked up correctly.
Discussion:
Statement CVE-2010-0747:
Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5 and Red Hat Enterprise MRG as they did not backport an out-of-tree drbd module (drbd8).
Statement CVE-2010-1446:
Not vulnerable. This issue di
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://securityreason.com/achievement_securityalert/83http://support.apple.com/kb/HT4435http://www.securityfocus.com/bid/39658http://www.securitytracker.com/id?1024723http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://securityreason.com/achievement_securityalert/83http://support.apple.com/kb/HT4435http://www.securityfocus.com/bid/39658http://www.securitytracker.com/id?1024723
2010-04-27
Published