Description
Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- Apple / darwin_streaming_server5.0.1 – 5.0.1
- Apple / darwin_streaming_server4.1.3 – 4.1.3
- Apple / mac_os_x10.2.1 – 10.2.1
- Apple / mac_os_x10.2.2 – 10.2.2
- Apple / mac_os_x10.2.3 – 10.2.3
- Apple / mac_os_x10.2.4 – 10.2.4
- Apple / mac_os_x10.2.5 – 10.2.5
- Apple / mac_os_x10.2.6 – 10.2.6
- Apple / mac_os_x10.2.7 – 10.2.7
- Apple / mac_os_x10.2.8 – 10.2.8
- Apple / mac_os_x10.3 – 10.3
- Apple / mac_os_x10.3.1 – 10.3.1
- Apple / mac_os_x10.3.2 – 10.3.2
- Apple / mac_os_x10.3.3 – 10.3.3
- Apple / mac_os_x10.3.4 – 10.3.4
- Apple / mac_os_x10.3.5 – 10.3.5
- Apple / mac_os_x10.2 – 10.2
- Apple / mac_os_x10.3.6 – 10.3.6
- Apple / mac_os_x_server10.3.6 – 10.3.6
- Apple / mac_os_x_server10.2 – 10.2
- Apple / mac_os_x_server10.2.1 – 10.2.1
- Apple / mac_os_x_server10.2.2 – 10.2.2
- Apple / mac_os_x_server10.2.3 – 10.2.3
- Apple / mac_os_x_server10.2.4 – 10.2.4
- Apple / mac_os_x_server10.2.5 – 10.2.5
- Apple / mac_os_x_server10.2.6 – 10.2.6
- Apple / mac_os_x_server10.2.7 – 10.2.7
- Apple / mac_os_x_server10.2.8 – 10.2.8
- Apple / mac_os_x_server10.3 – 10.3
- Apple / mac_os_x_server10.3.1 – 10.3.1
- Apple / mac_os_x_server10.3.2 – 10.3.2
- Apple / mac_os_x_server10.3.3 – 10.3.3
- Apple / mac_os_x_server10.3.4 – 10.3.4
- Apple / mac_os_x_server10.3.5 – 10.3.5
- Apple / quicktime_streaming_server4.1.1 – 4.1.1
References
- MISChttp://www.securityfocus.com/bid/11802
- VENDOR_ADVISORYhttp://secunia.com/advisories/13362/
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/18348
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
- MISChttp://www.ciac.org/ciac/bulletins/p-049.shtml