xcode 代码执行漏洞

CVE编号

CVE-2006-5327

利用情况

暂无

补丁情况

N/A

披露时间

2006-10-18

漏洞描述

Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html
http://secunia.com/advisories/22390
http://secunia.com/advisories/22474
http://secunia.com/advisories/27441
http://www.digitalmunition.com/DMA%5B2006-1016a%5D.txt
http://www.digitalmunition.com/Xcode_OpenBase_pwn.pl
http://www.securityfocus.com/bid/20562
http://www.securitytracker.com/id?1018872
http://www.vupen.com/english/advisories/2006/4058
http://www.vupen.com/english/advisories/2006/4059
http://www.vupen.com/english/advisories/2007/3665
https://exchange.xforce.ibmcloud.com/vulnerabilities/29624

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	apple	xcode	*		Up to (including) 2.2
	运行在以下环境
	应用	openbase_international_ltd	openbase	*		Up to (including) 10.0
	运行在以下环境
	应用	openbase_international_ltd	openbase	7.0.15	-
	运行在以下环境
	应用	openbase_international_ltd	openbase	8.0.4	-
	运行在以下环境
	应用	openbase_international_ltd	openbase	9.1.5	-

CVSS3评分 7.2

• 攻击路径 本地
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 完全地
• 保密性 完全地
• 完整性 完全地

AV:L/AC:L/Au:N/C:C/I:C/A:C

CWE-ID	漏洞类型
NVD-CWE-Other

Exp相关链接

- avd.aliyun.com