Vulnerability Name:

CVE-2007-0752 (CCN-34503)

Assigned:2007-05-24
Published:2007-05-24
Updated:2017-07-29
Summary:The PPP daemon (pppd) in Apple Mac OS X 10.4.8 checks ownership of the stdin file descriptor to determine if the invoker has sufficient privileges, which allows local users to load arbitrary plugins and gain root privileges by bypassing this check.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2007-0752

Source: CCN
Type: Apple Security Update 2007-005
About Security Update 2007-005

Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=305530

Source: CCN
Type: Apple Web site
Apple security updates

Source: IDEFENSE
Type: Vendor Advisory
20070524 Apple Computer Mac OS X pppd Plugin Loading Privilege Escalation Vulnerability

Source: APPLE
Type: UNKNOWN
APPLE-SA-2007-05-24

Source: SECUNIA
Type: UNKNOWN
25402

Source: CCN
Type: SECTRACK ID: 1018124
Mac OS X pppd Plugin Loading Feature Lets Local Users Gain Root Privileges

Source: OSVDB
Type: UNKNOWN
35144

Source: CCN
Type: OSVDB ID: 35144
Mac OS X PPP Daemon (pppd) Local Privilege Escalation

Source: BID
Type: UNKNOWN
24144

Source: CCN
Type: BID-24144
Apple Mac OS X 2007-005 Multiple Security Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1018124

Source: VUPEN
Type: UNKNOWN
ADV-2007-1939

Source: XF
Type: UNKNOWN
macos-pppd-privilege-escalation(34503)

Source: XF
Type: UNKNOWN
macos-pppd-privilege-escalation(34503)

Source: CCN
Type: iDefense Labs PUBLIC ADVISORY: 05.24.07
Apple Computer Mac OS X pppd Plugin Loading Privilege Escalation Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:apple:mac_os_x:10.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apple mac os x 10.4.8
    apple mac os x server 10.4.8
    apple mac os x 10.4
    apple mac os x 10.4.1
    apple mac os x server 10.4.1
    apple mac os x server 10.4
    apple mac os x server 10.4.2
    apple mac os x 10.4.2
    apple mac os x 10.4.4
    apple mac os x 10.4.3
    apple mac os x server 10.4.3
    apple mac os x server 10.4.4
    apple mac os x 10.4.5
    apple mac os x server 10.4.5
    apple mac os x 10.4.6
    apple mac os x server 10.4.6
    apple mac os x 10.4.7
    apple mac os x server 10.4.7
    apple mac os x server 10.4.8
    apple mac os x 10.4.8
    apple mac os x server 10.4.9
    apple mac os x 10.4.9
    apple mac os x 10.4.10
    apple mac os x server 10.4.10
    apple mac os x 10.4.11
    apple mac os x server 10.4.11