search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Apple Mac OS X IPSec mechanism fails to handle certain incoming security policies that match by port

Vulnerability Note VU#869548

Original Release Date: 2003-05-19 | Last Revised: 2003-05-19

Overview

Apple's Mac OS X IPSec implementation does not properly filter certain types of IP traffic.

Description

Apple Mac OS X contains an implementation of the IP Security Protocol (IPSec). A vulnerability in this implementation may allow a remote attacker to exchange traffic with a host that should not be reachable. For further details, please see Apple Security Update Article ID 61798.

Impact

A remote attacker may be able to bypass IPSec ACLs and reach a system that should not be reachable.

Solution

Apply a patch.

Vendor Information

869548
 

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

The CERT/CC thanks Apple for providing Apple Security Update Article ID 61798 upon which this document is based.

This document was written by Ian A Finlay.

Other Information

CVE IDs: CVE-2003-0242
Severity Metric: 18.00
Date Public: 2003-05-19
Date First Published: 2003-05-19
Date Last Updated: 2003-05-19 17:34 UTC
Document Revision: 7

Sponsored by CISA.