Details of VAR-201202-0152

ID

VAR-201202-0152

CVE

CVE-2011-3452

TITLE

Apple Mac OS X of Internet Sharing Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2012-001286

DESCRIPTION

Internet Sharing in Apple Mac OS X before 10.7.3 does not preserve the Wi-Fi configuration across software updates, which allows remote attackers to obtain sensitive information by leveraging the lack of a WEP password for a Wi-Fi network. Apple Mac OS X is prone to a security bypass vulnerability that affects the Internet Sharing component. An attacker can exploit this issue to gain unauthorized access to the Wi-Fi network. The following products are vulnerable: Mac OS X 10.7 to 10.7.2 Mac OS X Server 10.7 to 10.7.2 NOTE: This issue was previously discussed in BID 51798 (Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities) but has been given its own record to better document it. The vulnerability stems from Internet Sharing not maintaining the Wi-Fi configuration for the entire software update

Trust: 2.07

sources: NVD: CVE-2011-3452 // JVNDB: JVNDB-2012-001286 // BID: 51819 // VULHUB: VHN-51397 // VULMON: CVE-2011-3452

AFFECTED PRODUCTS

vendor:	apple	model:	mac os x server	scope:	eq	version:	10.7.0	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.7.1	Trust: 1.6
vendor:	apple	model:	mac os x server	scope:	eq	version:	10.7.1	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.7.0	Trust: 1.6
vendor:	apple	model:	mac os x	scope:	lte	version:	10.7.2	Trust: 1.0
vendor:	apple	model:	mac os x server	scope:	lte	version:	10.7.2	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	v10.7 to v10.7.2	Trust: 0.8
vendor:	apple	model:	mac os x server	scope:	eq	version:	v10.7 to v10.7.2	Trust: 0.8
vendor:	apple	model:	mac os x	scope:	eq	version:	10.7.2	Trust: 0.6
vendor:	apple	model:	mac os x server	scope:	eq	version:	10.7.2	Trust: 0.6
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.7.2	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.7.1	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	eq	version:	x10.7	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.7.2	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.7.1	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.7	Trust: 0.3
vendor:	apple	model:	mac os server	scope:	ne	version:	x10.7.3	Trust: 0.3
vendor:	apple	model:	mac os	scope:	ne	version:	x10.7.3	Trust: 0.3

sources: BID: 51819 // JVNDB: JVNDB-2012-001286 // CNNVD: CNNVD-201202-074 // NVD: CVE-2011-3452

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-3452
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2011-3452
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201202-074
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-51397
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2011-3452
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2011-3452
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-51397
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-51397 // VULMON: CVE-2011-3452 // JVNDB: JVNDB-2012-001286 // CNNVD: CNNVD-201202-074 // NVD: CVE-2011-3452

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-51397 // JVNDB: JVNDB-2012-001286 // NVD: CVE-2011-3452

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201202-074

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201202-074

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-001286

PATCH

title:

HT5130

url:

http://support.apple.com/kb/HT5130

Trust: 0.8

sources: JVNDB: JVNDB-2012-001286

EXTERNAL IDS

db:	NVD	id:	CVE-2011-3452	Trust: 2.9
db:	JVNDB	id:	JVNDB-2012-001286	Trust: 0.8
db:	CNNVD	id:	CNNVD-201202-074	Trust: 0.7
db:	APPLE	id:	APPLE-SA-2012-02-01-1	Trust: 0.6
db:	BID	id:	51819	Trust: 0.5
db:	VULHUB	id:	VHN-51397	Trust: 0.1
db:	VULMON	id:	CVE-2011-3452	Trust: 0.1

sources: VULHUB: VHN-51397 // VULMON: CVE-2011-3452 // BID: 51819 // JVNDB: JVNDB-2012-001286 // CNNVD: CNNVD-201202-074 // NVD: CVE-2011-3452

REFERENCES

url:	http://lists.apple.com/archives/security-announce/2012/feb/msg00000.html	Trust: 1.8
url:	http://support.apple.com/kb/ht5130	Trust: 1.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3452	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu382755	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3452	Trust: 0.8
url:	http://www.apple.com/macosx/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/200.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.securityfocus.com/bid/51819	Trust: 0.1

sources: VULHUB: VHN-51397 // VULMON: CVE-2011-3452 // BID: 51819 // JVNDB: JVNDB-2012-001286 // CNNVD: CNNVD-201202-074 // NVD: CVE-2011-3452

CREDITS

An anonymous researcher.

Trust: 0.3

sources: BID: 51819

SOURCES

db:	VULHUB	id:	VHN-51397
db:	VULMON	id:	CVE-2011-3452
db:	BID	id:	51819
db:	JVNDB	id:	JVNDB-2012-001286
db:	CNNVD	id:	CNNVD-201202-074
db:	NVD	id:	CVE-2011-3452

LAST UPDATE DATE

2025-04-11T20:08:42.889000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-51397	date:	2012-02-03T00:00:00
db:	VULMON	id:	CVE-2011-3452	date:	2012-02-03T00:00:00
db:	BID	id:	51819	date:	2012-02-01T00:00:00
db:	JVNDB	id:	JVNDB-2012-001286	date:	2012-02-06T00:00:00
db:	CNNVD	id:	CNNVD-201202-074	date:	2012-02-07T00:00:00
db:	NVD	id:	CVE-2011-3452	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-51397	date:	2012-02-02T00:00:00
db:	VULMON	id:	CVE-2011-3452	date:	2012-02-02T00:00:00
db:	BID	id:	51819	date:	2012-02-01T00:00:00
db:	JVNDB	id:	JVNDB-2012-001286	date:	2012-02-06T00:00:00
db:	CNNVD	id:	CNNVD-201202-074	date:	2012-02-07T00:00:00
db:	NVD	id:	CVE-2011-3452	date:	2012-02-02T18:55:01.287