Vulnerability Name:
CVE-2011-0197 (CCN-68208)
Assigned:
2010-12-23
Published:
2011-06-23
Updated:
2011-10-27
Summary:
App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions.
CVSS v3 Severity:
5.3 Medium
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
Low
Integrity (I):
None
Availibility (A):
None
CVSS v2 Severity:
2.1 Low
(CVSS v2 Vector:
AV:L/AC:L/Au:N/C:P/I:N/A:N
)
1.6 Low
(Temporal CVSS v2 Vector:
AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Local
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
None
Availibility (A):
None
5.0 Medium
(CCN CVSS v2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
)
3.7 Low
(CCN Temporal CVSS v2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
None
Availibility (A):
None
Vulnerability Type:
CWE-200
Vulnerability Consequences:
Obtain Information
References:
Source: MITRE
Type: CNA
CVE-2011-0197
Source: APPLE
Type: Patch, Vendor Advisory
APPLE-SA-2011-06-23-1
Source: CCN
Type: SA45054
Apple Mac OS X Multiple Vulnerabilities
Source: CCN
Type: Apple Web site
About the security content of Mac OS X v10.6.8 and Security Update 2011-004
Source: CONFIRM
Type: Patch, Vendor Advisory
http://support.apple.com/kb/HT4723
Source: CCN
Type: OSVDB ID: 73360
Apple Mac OS X App Store Local File AppleID Password Disclosure
Source: BID
Type: UNKNOWN
48443
Source: CCN
Type: BID-48443
Apple Mac OS X AppleID Local Information Disclosure Vulnerability
Source: XF
Type: UNKNOWN
macos-appleid-info-disc(68208)
Vulnerable Configuration:
Configuration 1
:
cpe:/o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.4:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.5:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.7:*:*:*:*:*:*:*
Configuration 2
:
cpe:/o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.4:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.5:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.7:*:*:*:*:*:*:*
Configuration CCN 1
:
cpe:/o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.4:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.4:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.5:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.5:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.6:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x_server:10.6.7:*:*:*:*:*:*:*
OR
cpe:/o:apple:mac_os_x:10.6.7:*:*:*:*:*:*:*
Denotes that component is vulnerable
BACK
apple
mac os x 10.5.8
apple
mac os x 10.6.0
apple
mac os x 10.6.1
apple
mac os x 10.6.2
apple
mac os x 10.6.3
apple
mac os x 10.6.4
apple
mac os x 10.6.5
apple
mac os x 10.6.6
apple
mac os x 10.6.7
apple
mac os x server 10.5.8
apple
mac os x server 10.6.0
apple
mac os x server 10.6.1
apple
mac os x server 10.6.2
apple
mac os x server 10.6.3
apple
mac os x server 10.6.4
apple
mac os x server 10.6.5
apple
mac os x server 10.6.6
apple
mac os x server 10.6.7
apple
mac os x 10.5.8
apple
mac os x server 10.5.8
apple
mac os x server 10.6
apple
mac os x 10.6
apple
mac os x server 10.6.1
apple
mac os x 10.6.1
apple
mac os x server 10.6.2
apple
mac os x 10.6.2
apple
mac os x 10.6.3
apple
mac os x server 10.6.3
apple
mac os x server 10.6.4
apple
mac os x 10.6.4
apple
mac os x server 10.6.5
apple
mac os x 10.6.5
apple
mac os x server 10.6.6
apple
mac os x 10.6.6
apple
mac os x server 10.6.7
apple
mac os x 10.6.7