Vulnerability Note VU#126787

Apple Mac OS X file sharing allows authenticated remote access to files and directories

Overview

Apple Mac OS X Leopard does not accurately reflect which files and directories are available via sharing.

I. Description

Apple Mac OS X Leopard (10.5.x) allows files and directories to be shared via a "Shared Folders" feature. OS X lists the folders that are shared using this feature, however the list is incomplete. An authenticated user can access his home directory remotely, and an authenticated administrator can remotely access the entire hard drive.

II. Impact

A system that is configured with Shared Folders enabled may be exposing more files and directories than expected.

III. Solution

Apply an update

This issue is addressed in Apple Mac OS X 10.5.5. This update causes OS X to more accurately explain which files and directories are shared. Please see the Apple Advisory for more details.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Computer, Inc.	Vulnerable	2007-12-13	2008-09-15

References

http://support.apple.com/kb/HT3137

Credit

Thanks to Russ Andersson for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

Date Public:	2008-09-15
Date First Published:	2008-09-15
Date Last Updated:	2008-10-13
CERT Advisory:
CVE-ID(s):	CVE-2008-3618
NVD-ID(s):	CVE-2008-3618
US-CERT Technical Alerts:
Metric:	1.01
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader