var-200605-0197
Vulnerability from variot

Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service. Xcode Tools is prone to an unauthorized remote access vulnerability through the WebObjects plug-in. A remote attacker can exploit this issue to manipulate projects through the network service. This issue affects only those systems with the Xcode Tools WebObjects plug-in installed.

TITLE: Apple Xcode WebObjects Plugin Access Control Vulnerability

SECUNIA ADVISORY ID: SA20267

VERIFY ADVISORY: http://secunia.com/advisories/20267/

CRITICAL: Less critical

IMPACT: Security Bypass

WHERE:

From local network

SOFTWARE: Apple Xcode 2.x http://secunia.com/product/10144/

DESCRIPTION: A vulnerability has been reported in Apple Xcode, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability has been reported in versions prior to 2.3.

SOLUTION: Update to version 2.3. http://developer.apple.com/tools/download/

PROVIDED AND/OR DISCOVERED BY: The vendor credits Mike Schrag of mDimension Technology.

ORIGINAL ADVISORY: http://docs.info.apple.com/article.html?artnum=303794

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200605-0197",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4"
      },
      {
        "model": "xcode",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "2.2"
      },
      {
        "model": "xcode",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "apple",
        "version": "2.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.6"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4"
      },
      {
        "model": "xcode",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "2.3"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mike Schrag of mDimension Technology is credited with the discovery of this vulnerability.",
    "sources": [
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2006-1466",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "VHN-17574",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:H/AU:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2006-1466",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200605-426",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-17574",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service. Xcode Tools is prone to an unauthorized remote access vulnerability through the WebObjects plug-in. \nA remote attacker can exploit this issue to manipulate projects through the network service. \nThis issue affects only those systems with the Xcode Tools WebObjects plug-in installed. \n\nTITLE:\nApple Xcode WebObjects Plugin Access Control Vulnerability\n\nSECUNIA ADVISORY ID:\nSA20267\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/20267/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom local network\n\nSOFTWARE:\nApple Xcode 2.x\nhttp://secunia.com/product/10144/\n\nDESCRIPTION:\nA vulnerability has been reported in Apple Xcode, which can be\nexploited by malicious people to bypass certain security\nrestrictions. \n\nThe vulnerability has been reported in versions prior to 2.3. \n\nSOLUTION:\nUpdate to version 2.3. \nhttp://developer.apple.com/tools/download/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Mike Schrag of mDimension Technology. \n\nORIGINAL ADVISORY:\nhttp://docs.info.apple.com/article.html?artnum=303794\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "db": "PACKETSTORM",
        "id": "46649"
      }
    ],
    "trust": 1.35
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2006-1466",
        "trust": 2.0
      },
      {
        "db": "BID",
        "id": "18091",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "20267",
        "trust": 1.8
      },
      {
        "db": "VUPEN",
        "id": "ADV-2006-1950",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "25889",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1016143",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426",
        "trust": 0.7
      },
      {
        "db": "XF",
        "id": "26634",
        "trust": 0.6
      },
      {
        "db": "APPLE",
        "id": "APPLE-SA-2006-05-23",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-17574",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "46649",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "PACKETSTORM",
        "id": "46649"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "id": "VAR-200605-0197",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:53:28.797000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2006/may/msg00004.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/18091"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/25889"
      },
      {
        "trust": 1.7,
        "url": "http://securitytracker.com/id?1016143"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/20267"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2006/1950"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26634"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/26634"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2006/1950"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/10144/"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=303794"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/20267/"
      },
      {
        "trust": 0.1,
        "url": "http://developer.apple.com/tools/download/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "PACKETSTORM",
        "id": "46649"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "db": "BID",
        "id": "18091"
      },
      {
        "db": "PACKETSTORM",
        "id": "46649"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-05-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "date": "2006-05-23T00:00:00",
        "db": "BID",
        "id": "18091"
      },
      {
        "date": "2006-05-26T01:12:24",
        "db": "PACKETSTORM",
        "id": "46649"
      },
      {
        "date": "2006-05-24T01:02:00",
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "date": "2006-05-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-17574"
      },
      {
        "date": "2006-05-24T17:23:00",
        "db": "BID",
        "id": "18091"
      },
      {
        "date": "2017-07-20T01:30:37.473000",
        "db": "NVD",
        "id": "CVE-2006-1466"
      },
      {
        "date": "2006-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Xcode Tools WebObjects Permissions and Access Control Vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access verification error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-426"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.