Apple Mac Os X Server vulnerabilities

CVE-2005-1689 [CRITICAL] CWE-415 CVE-2005-1689: Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier a Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.

CVE-2005-1722 [HIGH] CVE-2005-1722: Unknown vulnerability in the CoreGraphics Window Server for Mac OS X 10.4.x up to 10.4.1 allows loca Unknown vulnerability in the CoreGraphics Window Server for Mac OS X 10.4.x up to 10.4.1 allows local users to inject arbitrary commands into root sessions.

CVE-2005-1474 [HIGH] CVE-2005-1474: Dashboard in Apple Mac OS X 10.4.1 allows remote attackers to install widgets via Safari without pro Dashboard in Apple Mac OS X 10.4.1 allows remote attackers to install widgets via Safari without prompting the user, a different vulnerability than CVE-2005-1933.

CVE-2005-1724 [HIGH] CVE-2005-1724: NFS on Apple Mac OS X 10.4.x up to 10.4.1 does not properly obey the -network or -mask flags for a f NFS on Apple Mac OS X 10.4.x up to 10.4.1 does not properly obey the -network or -mask flags for a filesystem and exports it to everyone, which allows remote attackers to bypass intended access restrictions.

CVE-2005-1723 [HIGH] CVE-2005-1723: LaunchServices in Apple Mac OS X 10.4.x up to 10.4.1 does not properly mark file extensions and MIME LaunchServices in Apple Mac OS X 10.4.x up to 10.4.1 does not properly mark file extensions and MIME types as unsafe if an Apple Uniform Type Identifier (UTI) is not created when the type is added to the database of unsafe types, which could allow attackers to bypass intended restrictions.

CVE-2005-1727 [LOW] CVE-2005-1727: Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the (1) s Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the (1) system cache folder and (2) Dashboard system widgets, which allows local users to conduct unauthorized file operations via "file race conditions."

CVE-2005-1725 [LOW] CVE-2005-1725: launchd 106 in Apple Mac OS X 10.4.x up to 10.4.1 allows local users to overwrite arbitrary files vi launchd 106 in Apple Mac OS X 10.4.x up to 10.4.1 allows local users to overwrite arbitrary files via a symlink attack on the socket file in an insecure temporary directory.

CVE-2005-0972 [HIGH] CVE-2005-0972: Integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to ex Integer overflow in the searchfs system call in Mac OS X 10.3.9 and earlier allows local users to execute arbitrary code via crafted parameters.

CVE-2005-1339 [HIGH] CVE-2005-1339: lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by l lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by logging in with their full name.

CVE-2005-0594 [HIGH] CVE-2005-0594: Buffer overflow in the Netinfo Setup Tool (NeST) allows local users to execute arbitrary code. Buffer overflow in the Netinfo Setup Tool (NeST) allows local users to execute arbitrary code.

CVE-2005-1335 [HIGH] CVE-2005-1335: Unknown vulnerability in Mac OS X 10.3.9 allows local users to gain privileges via (1) chfn, (2) chp Unknown vulnerability in Mac OS X 10.3.9 allows local users to gain privileges via (1) chfn, (2) chpass, and (3) chsh, which "use external helper programs in an insecure manner."

CVE-2005-1337 [HIGH] CVE-2005-1337: Apple Help Viewer 2.0.7 and 3.0.0 in Mac OS X 10.3.9 allows remote attackers to read and execute arb Apple Help Viewer 2.0.7 and 3.0.0 in Mac OS X 10.3.9 allows remote attackers to read and execute arbitrary scrpts with less restrictive privileges via a help:// URI.

CVE-2005-1332 [HIGH] CVE-2005-1332: Bluetooth-enabled systems in Mac OS X 10.3.9 enables the Bluetooth file exchange service by default, Bluetooth-enabled systems in Mac OS X 10.3.9 enables the Bluetooth file exchange service by default, which allows remote attackers to access files without the user being notified, and local users to access files via the default directory.

CVE-2005-1331 [MEDIUM] CVE-2005-1331: The AppleScript Editor in Mac OS X 10.3.9 does not properly display script code for an applescript: The AppleScript Editor in Mac OS X 10.3.9 does not properly display script code for an applescript: URI, which can result in code that is different than the actual code that would be run, which could allow remote attackers to trick users into executing malicious code via certain URI characters such as NULL, control characters, and homographs.

CVE-2005-1341 [MEDIUM] CVE-2005-1341: Apple Terminal 1.4.4 allows attackers to execute arbitrary commands via terminal escape sequences. Apple Terminal 1.4.4 allows attackers to execute arbitrary commands via terminal escape sequences.

CVE-2005-1330 [MEDIUM] CWE-20 CVE-2005-1330: AppKit in Mac OS X 10.3.9 allows attackers to cause a denial of service (Cocoa application crash) vi AppKit in Mac OS X 10.3.9 allows attackers to cause a denial of service (Cocoa application crash) via a malformed TIFF image that causes the NXSeek to use an incorrect offset, leading to an unhandled exception.

CVE-2005-1343 [HIGH] CVE-2005-1343: Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users t Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.

CVE-2005-1430 [LOW] CVE-2005-1430: Mac OS X 10.3.x and earlier uses insecure permissions for a pseudo terminal tty (pty) that is manage Mac OS X 10.3.x and earlier uses insecure permissions for a pseudo terminal tty (pty) that is managed by a non-setuid program, which allows local users to read or modify sessions of other users.

CVE-2005-0125 [HIGH] CVE-2005-0125: The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to (1) delete arbitrary files via atrm, (2) execute arbitrary programs via the -f argument to batch, or (3) read arbitrary files via the -f argument to batch, which generates a job file that is readable by the local user.

CVE-2005-0126 [HIGH] CVE-2005-0126: ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.