Vulnerability Note VU#474969

Apple Macintosh OS X fails to properly mount WebDAV filesystems

Original Release date: 20 Apr 2007 | Last revised: 20 Apr 2007

Overview

A vulnerability in the way that Apple Macintosh OS X mounts WebDAV filesystems could allow a local attacker to execute commands with elevated privileges.

Description

Web-based Distributed Authoring and Versioning (WebDAV) is a set of extensions to the HTTP protocol which allows collaborative editing and management of web resources on remote servers. Apple Macintosh OS X contains a vulnerability that could be exploited when it attempts to mount WebDAV filesystems that may allow a local attacker to execute commands with elevated privileges. According to Apple Security Update 2007-004:

    When mounting a WebDAV filesystem, the load_webdav program may be launched without properly cleaning the environment. This may allow a local user to create files or execute commands with system privileges. This update addresses the issue by cleaning the environment prior to executing commands.

Impact

A local attacker may be able to execute commands with elevated privileges.

Solution

Apply Updates from Apple
Apple has addressed this vulnerability with the updates included in Apple Security Update 2007-004.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Apple Computer, Inc.Affected-20 Apr 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported in Apple Security Update 2007-004.

This document was written by Chris Taschner.

Other Information

  • CVE IDs: CVE-2007-0747
  • Date Public: 19 Apr 2007
  • Date First Published: 20 Apr 2007
  • Date Last Updated: 20 Apr 2007
  • Severity Metric: 3.64
  • Document Revision: 17

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.