Apple Mac OS X up to 10.4.8 UserNotificationCenter.app Remote Code Execution
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.9 | $0-$5k | 0.00 |
A vulnerability classified as critical was found in Apple Mac OS X up to 10.4.8 (Operating System). This vulnerability affects some unknown functionality of the file UserNotificationCenter.app. The manipulation with an unknown input leads to a remote code execution vulnerability. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil, allows local users to gain privileges via a malicious InputManager in Library/InputManagers in a user s home directory, which is executed when Cocoa applications attempt to notify the user.
The bug was discovered 01/22/2007. The weakness was disclosed 01/24/2007 by Kevin Finisterre with MOAB (Website). The advisory is shared for download at projects.info-pull.com. This vulnerability was named CVE-2007-0023 since 01/02/2007. The attack can only be initiated within the local network. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known.
After even before and not, there has been an exploit disclosed. It is possible to download the exploit at projects.info-pull.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 24354 (Mac OS X Multiple Vulnerabilities (Security Update 2007-002)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family MacOS X Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 115515 (Apple Mac OS X Security Update 2007-002 Not Installed (APPLE-SA-2007-02-15)).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at apple.com. The problem might be mitigated by replacing the product with as an alternative. The best possible mitigation is suggested to be establishing an alternative product. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (31676) and Tenable (24354). The entries 34343, 34739, 34738 and 34551 are pretty similar.
Product
Type
Vendor
Name
Version
License
Support
- end of life
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.8VulDB Meta Temp Score: 7.9
VulDB Base Score: 8.8
VulDB Temp Score: 7.9
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Remote Code ExecutionCWE: Unknown
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Partially
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Nessus ID: 24354
Nessus Name: Mac OS X Multiple Vulnerabilities (Security Update 2007-002)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: AlternativeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: apple.com
Timeline
01/02/2007 🔍01/22/2007 🔍
01/22/2007 🔍
01/22/2007 🔍
01/23/2007 🔍
01/23/2007 🔍
01/24/2007 🔍
01/24/2007 🔍
01/24/2007 🔍
01/26/2007 🔍
01/29/2007 🔍
02/15/2007 🔍
02/16/2007 🔍
02/19/2007 🔍
07/14/2019 🔍
Sources
Vendor: apple.comAdvisory: projects.info-pull.com
Researcher: Kevin Finisterre
Organization: MOAB
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2007-0023 (🔍)
X-Force: 31676 - Apple Mac OS X InputManager privilege escalation, High Risk
SecurityTracker: 1017542
Vulnerability Center: 14330 - Apple Mac OS X 10.4.8 Local Privilege Escalation due to a Vulnerability in UserNotificationCenter, Medium
SecurityFocus: 22188 - Apple UserNotificationCenter Local Privilege Escalation Vulnerability
Secunia: 23846 - Apple Mac OS X "UserNotificationCenter" Privilege Escalation, Less Critical
OSVDB: 32695 - Apple Mac OS X UserNotificationCenter.app CFUserNotificationSendRequest Function Privilege Escalation
Vupen: ADV-2007-0074
scip Labs: https://www.scip.ch/en/?labs.20150108
See also: 🔍
Entry
Created: 01/26/2007 13:03Updated: 07/14/2019 20:19
Changes: 01/26/2007 13:03 (102), 07/14/2019 20:19 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.