ID

VAR-200703-0025


CVE

CVE-2007-0724


TITLE

Apple Mac OS X DirectoryService may allow arbitrary users to change the root password

Trust: 0.8

sources: CERT/CC: VU#557064

DESCRIPTION

The IOKit HID interface in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 does not sufficiently limit access to certain controls, which allows local users to gain privileges by using HID device events to read keystrokes from the console. A vulnerabilty in the Apple Mac OS X DirectoryService may allow unprivileged users to change the root password. Apple ColorSync contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code. A vulnerability exists in the version of the telnet daemon included with the MIT Kerberos 5 distribution that may allow a remote, unauthorized attacker to log on to the system with elevated privileges. According to Apple information, keystrokes can be captured and potentially sensitive information such as passwords can be read. Mac OS X is prone to multiple vulnerabilities including stack-based buffer-overflow issues, denial-of-service vulnerabilities, two memory-corruption issues, an integer-overflow issue, two authentication-bypass issues, an information-disclosure vulnerability, and an insecure command-execution issue. An attacker can exploit these issues to execute arbitrary code in the context of the user running the application, cause denial-of-service conditions, compromise the application, and access or modify data. Few details regarding these issues are currently available. Separate BIDs for each issue will be created as new information becomes available. Mac OS X and Mac OS X Server versions 10.3.9 and 10.4 through 10.4.8 are vulnerable. ---------------------------------------------------------------------- Secunia customers receive relevant and filtered advisories. Delivery is done via different channels including SMS, Email, Web, and https based XML feed. http://corporate.secunia.com/trial/38/request/ ---------------------------------------------------------------------- TITLE: Sun SEAM Kerberized telnetd Daemon Arbitrary User Login SECUNIA ADVISORY ID: SA24755 VERIFY ADVISORY: http://secunia.com/advisories/24755/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: >From remote SOFTWARE: Sun SEAM 1.x http://secunia.com/product/1006/ DESCRIPTION: Sun has acknowledged a vulnerability in SEAM, which can be exploited by malicious people to bypass certain security restrictions. For more information: SA24740 SOLUTION: The vendor recommends disabling the Kerberized telnetd(1M) service by editing the inetd.conf file, or enabling the non-Kerberized in.telnetd(1M) daemon instead. Please see the vendor's advisory for details. Use in a trusted network environment only. ORIGINAL ADVISORY: Sun: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102867-1 OTHER REFERENCES: SA24740: http://secunia.com/advisories/24740 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 4.23

sources: NVD: CVE-2007-0724 // CERT/CC: VU#557064 // CERT/CC: VU#449440 // CERT/CC: VU#220816 // JVNDB: JVNDB-2007-000307 // BID: 22948 // VULHUB: VHN-24086 // PACKETSTORM: 55648

AFFECTED PRODUCTS

vendor:apple computermodel: - scope: - version: -

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.2

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.5

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.6

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.4

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.3.9

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.8

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.1

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.7

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4

Trust: 1.6

vendor:applemodel:mac os xscope:eqversion:10.4.3

Trust: 1.6

vendor:applemodel:mac os x serverscope:eqversion:10.4.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.7

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.1

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.6

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.4.8

Trust: 1.0

vendor:debian gnu linuxmodel: - scope: - version: -

Trust: 0.8

vendor:fedoramodel: - scope: - version: -

Trust: 0.8

vendor:gentoo linuxmodel: - scope: - version: -

Trust: 0.8

vendor:mit kerberos teammodel: - scope: - version: -

Trust: 0.8

vendor:mandrivamodel: - scope: - version: -

Trust: 0.8

vendor:red hatmodel: - scope: - version: -

Trust: 0.8

vendor:suse linuxmodel: - scope: - version: -

Trust: 0.8

vendor:sun microsystemsmodel: - scope: - version: -

Trust: 0.8

vendor:trustix secure linuxmodel: - scope: - version: -

Trust: 0.8

vendor:ubuntumodel: - scope: - version: -

Trust: 0.8

vendor:rpathmodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:v10.4 to 10.4.9 up to version

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.4 to 10.4.9 up to version

Trust: 0.8

vendor:applemodel:mac os serverscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.7

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.6

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.5

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.3

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.3.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.9

Trust: 0.3

vendor:applemodel:mac os serverscope:neversion:x10.4.9

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.4.9

Trust: 0.3

sources: CERT/CC: VU#557064 // CERT/CC: VU#449440 // CERT/CC: VU#220816 // BID: 22948 // JVNDB: JVNDB-2007-000307 // CNNVD: CNNVD-200703-367 // NVD: CVE-2007-0724

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-0724
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#557064
value: 4.50

Trust: 0.8

CARNEGIE MELLON: VU#449440
value: 10.33

Trust: 0.8

CARNEGIE MELLON: VU#220816
value: 17.85

Trust: 0.8

NVD: CVE-2007-0724
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200703-367
value: MEDIUM

Trust: 0.6

VULHUB: VHN-24086
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2007-0724
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-24086
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#557064 // CERT/CC: VU#449440 // CERT/CC: VU#220816 // VULHUB: VHN-24086 // JVNDB: JVNDB-2007-000307 // CNNVD: CNNVD-200703-367 // NVD: CVE-2007-0724

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-0724

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-200703-367

TYPE

Boundary Condition Error

Trust: 0.9

sources: BID: 22948 // CNNVD: CNNVD-200703-367

CONFIGURATIONS

sources: JVNDB: JVNDB-2007-000307

PATCH

title:Security Update 2007-004 v1.1 (Universal)url:http://www.apple.com/support/downloads/securityupdate2007004v11universal.html

Trust: 0.8

title:Security Update 2007-004 v1.1 (PPC)url:http://www.apple.com/support/downloads/securityupdate2007004v11ppc.html

Trust: 0.8

title:Security Update 2007-004url:http://docs.info.apple.com/article.html?artnum=305391-en

Trust: 0.8

title:Security Update 2007-004url:http://docs.info.apple.com/article.html?artnum=305391-ja

Trust: 0.8

title:Security Update 2007-004 v1.1 (Universal)url:http://www.apple.com/jp/ftp-info/reference/securityupdate2007004v11universal.html

Trust: 0.8

title:Security Update 2007-004 v1.1 (PPC)url:http://www.apple.com/jp/ftp-info/reference/securityupdate2007004v11ppc.html

Trust: 0.8

sources: JVNDB: JVNDB-2007-000307

EXTERNAL IDS

db:SECUNIAid:24479

Trust: 4.1

db:NVDid:CVE-2007-0724

Trust: 2.8

db:BIDid:22948

Trust: 2.8

db:SECTRACKid:1017942

Trust: 2.5

db:SECTRACKid:1017751

Trust: 2.5

db:USCERTid:TA07-109A

Trust: 2.5

db:SECUNIAid:24966

Trust: 2.5

db:VUPENid:ADV-2007-1470

Trust: 1.7

db:VUPENid:ADV-2007-0930

Trust: 1.7

db:USCERTid:TA07-072A

Trust: 1.7

db:OSVDBid:34855

Trust: 1.7

db:XFid:32973

Trust: 1.4

db:CERT/CCid:VU#557064

Trust: 1.1

db:CERT/CCid:VU#449440

Trust: 1.1

db:SECUNIAid:24755

Trust: 0.9

db:SECTRACKid:1017848

Trust: 0.8

db:SECUNIAid:24735

Trust: 0.8

db:SECUNIAid:24740

Trust: 0.8

db:SECUNIAid:24750

Trust: 0.8

db:SECUNIAid:24757

Trust: 0.8

db:CERT/CCid:VU#220816

Trust: 0.8

db:USCERTid:SA07-109A

Trust: 0.8

db:JVNDBid:JVNDB-2007-000307

Trust: 0.8

db:CNNVDid:CNNVD-200703-367

Trust: 0.7

db:APPLEid:APPLE-SA-2007-03-13

Trust: 0.6

db:APPLEid:APPLE-SA-2007-04-19

Trust: 0.6

db:CERT/CCid:TA07-109A

Trust: 0.6

db:CERT/CCid:TA07-072A

Trust: 0.6

db:VULHUBid:VHN-24086

Trust: 0.1

db:PACKETSTORMid:55648

Trust: 0.1

sources: CERT/CC: VU#557064 // CERT/CC: VU#449440 // CERT/CC: VU#220816 // VULHUB: VHN-24086 // BID: 22948 // PACKETSTORM: 55648 // JVNDB: JVNDB-2007-000307 // CNNVD: CNNVD-200703-367 // NVD: CVE-2007-0724

REFERENCES

url:http://docs.info.apple.com/article.html?artnum=305214

Trust: 3.3

url:http://www.securityfocus.com/bid/22948

Trust: 2.5

url:http://www.us-cert.gov/cas/techalerts/ta07-109a.html

Trust: 2.5

url:http://www.securitytracker.com/id?1017751

Trust: 2.5

url:http://www.securitytracker.com/id?1017942

Trust: 2.5

url:http://secunia.com/advisories/24479

Trust: 2.5

url:http://secunia.com/advisories/24966

Trust: 2.5

url:http://docs.info.apple.com/article.html?artnum=305391

Trust: 2.0

url:http://lists.apple.com/archives/security-announce/2007/mar/msg00002.html

Trust: 1.7

url:http://lists.apple.com/archives/security-announce/2007/apr/msg00001.html

Trust: 1.7

url:http://www.us-cert.gov/cas/techalerts/ta07-072a.html

Trust: 1.7

url:http://www.osvdb.org/34855

Trust: 1.7

url:http://secunia.com/advisories/24479/

Trust: 1.6

url:http://www.frsirt.com/english/advisories/2007/1470

Trust: 1.4

url:http://www.frsirt.com/english/advisories/2007/0930

Trust: 1.4

url:http://xforce.iss.net/xforce/xfdb/32973

Trust: 1.4

url:http://www.vupen.com/english/advisories/2007/0930

Trust: 1.1

url:http://www.vupen.com/english/advisories/2007/1470

Trust: 1.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/32973

Trust: 1.1

url:http://secunia.com/advisories/24755/

Trust: 0.9

url:http://www.apple.com/macosx/features/colorsync/

Trust: 0.8

url:http://images.apple.com/pro/pdf/color_management_in_mac_os_x.pdf

Trust: 0.8

url:http://en.wikipedia.org/wiki/colorsync

Trust: 0.8

url:http://www.cert.org/homeusers/buffer_overflow.html

Trust: 0.8

url:http://web.mit.edu/kerberos/advisories/mitkrb5-sa-2007-001-telnetd.txt

Trust: 0.8

url:http://secunia.com/advisories/24757/

Trust: 0.8

url:http://secunia.com/advisories/24735/

Trust: 0.8

url:http://secunia.com/advisories/24750/

Trust: 0.8

url:http://secunia.com/advisories/24740/

Trust: 0.8

url:http://securitytracker.com/alerts/2007/apr/1017848.html

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0724

Trust: 0.8

url:http://jvn.jp/cert/jvnta07-109a/index.html

Trust: 0.8

url:http://jvn.jp/tr/trta07-109a/index.html

Trust: 0.8

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-0724

Trust: 0.8

url:http://www.us-cert.gov/cas/alerts/sa07-109a.html

Trust: 0.8

url:http://software.cisco.com/download/navigator.html?mdfid=283613663

Trust: 0.3

url:http://www.kb.cert.org/vuls/id/449440

Trust: 0.3

url:http://www.kb.cert.org/vuls/id/557064

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://corporate.secunia.com/trial/38/request/

Trust: 0.1

url:http://secunia.com/product/1006/

Trust: 0.1

url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102867-1

Trust: 0.1

url:http://secunia.com/advisories/24740

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: CERT/CC: VU#557064 // CERT/CC: VU#449440 // CERT/CC: VU#220816 // VULHUB: VHN-24086 // BID: 22948 // PACKETSTORM: 55648 // JVNDB: JVNDB-2007-000307 // CNNVD: CNNVD-200703-367 // NVD: CVE-2007-0724

CREDITS

Tom Ferris※ tommy@security-protocols.com

Trust: 0.6

sources: CNNVD: CNNVD-200703-367

SOURCES

db:CERT/CCid:VU#557064
db:CERT/CCid:VU#449440
db:CERT/CCid:VU#220816
db:VULHUBid:VHN-24086
db:BIDid:22948
db:PACKETSTORMid:55648
db:JVNDBid:JVNDB-2007-000307
db:CNNVDid:CNNVD-200703-367
db:NVDid:CVE-2007-0724

LAST UPDATE DATE

2025-07-06T20:10:23.911000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#557064date:2007-03-14T00:00:00
db:CERT/CCid:VU#449440date:2007-03-14T00:00:00
db:CERT/CCid:VU#220816date:2007-05-16T00:00:00
db:VULHUBid:VHN-24086date:2017-07-29T00:00:00
db:BIDid:22948date:2007-04-20T17:11:00
db:JVNDBid:JVNDB-2007-000307date:2007-05-17T00:00:00
db:CNNVDid:CNNVD-200703-367date:2007-03-14T00:00:00
db:NVDid:CVE-2007-0724date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:CERT/CCid:VU#557064date:2007-03-14T00:00:00
db:CERT/CCid:VU#449440date:2007-03-14T00:00:00
db:CERT/CCid:VU#220816date:2007-04-03T00:00:00
db:VULHUBid:VHN-24086date:2007-03-13T00:00:00
db:BIDid:22948date:2007-03-05T00:00:00
db:PACKETSTORMid:55648date:2007-04-05T05:27:45
db:JVNDBid:JVNDB-2007-000307date:2007-05-17T00:00:00
db:CNNVDid:CNNVD-200703-367date:2007-03-13T00:00:00
db:NVDid:CVE-2007-0724date:2007-03-13T22:19:00