Apple Mac OS X up to 10.10 SMBClient Kernel Memory information disclosure
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
3.6 | $0-$5k | 0.00 |
A vulnerability was found in Apple Mac OS X up to 10.10 (Operating System). It has been classified as problematic. This affects an unknown part of the component SMBClient. The manipulation with an unknown input leads to a information disclosure vulnerability (Kernel Memory). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:
SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
The weakness was presented 10/09/2015 (Website). The advisory is shared at support.apple.com. This vulnerability is uniquely identified as CVE-2015-5893 since 08/06/2015. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.
A public exploit has been developed in Python. The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept.
Upgrading to version 10.11 eliminates this vulnerability.
See 67455, 78301, 78310 and 78311 for similar entries.
Product
Type
Vendor
Name
Version
License
Support
- end of life
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.0VulDB Meta Temp Score: 3.6
VulDB Base Score: 4.0
VulDB Temp Score: 3.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Name: Kernel MemoryClass: Information disclosure / Kernel Memory
CWE: CWE-200 / CWE-284 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Programming Language: 🔍
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 801105
OpenVAS Name: Apple Mac OS X Multiple Vulnerabilities-02 October-15
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Mac OS X 10.11
Timeline
08/06/2015 🔍09/30/2015 🔍
10/01/2015 🔍
10/09/2015 🔍
10/09/2015 🔍
10/12/2015 🔍
06/20/2022 🔍
Sources
Vendor: apple.comAdvisory: support.apple.com
Status: Not defined
Confirmation: 🔍
CVE: CVE-2015-5893 (🔍)
SecurityTracker: 1033703
Vulnerability Center: 53078 - Apple MacOS X before 10.11 Local Information Disclosure in Kernel - CVE-2015-5893, Low
SecurityFocus: 76908
scip Labs: https://www.scip.ch/en/?labs.20150108
See also: 🔍
Entry
Created: 10/12/2015 10:31Updated: 06/20/2022 14:16
Changes: 10/12/2015 10:31 (53), 02/01/2018 07:20 (15), 06/20/2022 14:16 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.