Overview
A vulnerability in the way that Apple Macintosh OS X mounts WebDAV filesystems could allow a local attacker to execute commands with elevated privileges.
Description
Web-based Distributed Authoring and Versioning (WebDAV) is a set of extensions to the HTTP protocol which allows collaborative editing and management of web resources on remote servers. Apple Macintosh OS X contains a vulnerability that could be exploited when it attempts to mount WebDAV filesystems that may allow a local attacker to execute commands with elevated privileges. According to Apple Security Update 2007-004: When mounting a WebDAV filesystem, the load_webdav program may be launched without properly cleaning the environment. This may allow a local user to create files or execute commands with system privileges. This update addresses the issue by cleaning the environment prior to executing commands. |
Impact
A local attacker may be able to execute commands with elevated privileges. |
Solution
Apply Updates from Apple Apple has addressed this vulnerability with the updates included in Apple Security Update 2007-004. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported in Apple Security Update 2007-004.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2007-0747 |
| Severity Metric: | 3.65 |
| Date Public: | 2007-04-19 |
| Date First Published: | 2007-04-20 |
| Date Last Updated: | 2007-04-20 16:17 UTC |
| Document Revision: | 19 |