Vulnerability Note VU#681056

Apple Mac OS X CFNetwork may allow arbitrary FTP commands to be executed via a crafted FTP URI

Overview

Apple Mac OS X CFNetwork may allow arbitrary FTP commands to be executed via a crafted FTP URI.

I. Description

According to Apple Security Update 2006-007:

By enticing a user to access a maliciously crafted FTP URI, an attacker can cause the user's FTP client to issue arbitrary FTP commands to any accessible FTP server, using the credentials of the victim. This issue may also facilitate attacks of other line oriented protocols, such as SMTP.

II. Impact

By convincing a user to open a specially crafted web page or click a link, a remote, unauthenticated attacker may be able to execute arbitrary FTP commands.

III. Solution

Apply Apple Updates

This issue is addressed by Apple Security Update 2006-007.

Systems Affected

Vendor	Status	Date Updated
Apple Computer, Inc.	Vulnerable	29-Nov-2006

References

http://docs.info.apple.com/article.html?artnum=304829
http://secunia.com/advisories/23155/

Credit

This issue was reported in Apple Security Update 2006-007.

This document was written by Chris Taschner.

Other Information

Date Public	11/28/2006
Date First Published	11/30/2006 10:47:31 AM
Date Last Updated	12/01/2006
CERT Advisory
CVE-ID(s)	CVE-2006-4401
NVD-ID(s)	CVE-2006-4401
US-CERT Technical Alerts
Metric	17.55
Document Revision	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader