CVE-2012-6646 in PSB Workstation Security
Summary
by MITRE
F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/11/2026
The vulnerability identified as CVE-2012-6646 affects multiple F-Secure security products including Anti-Virus, Safe Anywhere, and PSB Workstation Security versions prior to 11500 on Mac OS X operating systems. This represents a critical security flaw that undermines the fundamental network protection mechanisms available to Mac users. The vulnerability specifically targets the Mac OS X firewall functionality, which serves as a crucial first line of defense against unauthorized network access and malicious traffic. The issue stems from the improper handling of firewall configuration parameters within the F-Secure security suite, creating an avenue for local attackers to manipulate system security settings without requiring elevated privileges.
The technical nature of this vulnerability falls under the category of privilege escalation and configuration modification, with direct implications for system integrity and network security posture. Attackers exploiting this flaw can disable the built-in Mac OS X firewall through unspecified vectors that likely involve manipulation of system processes or configuration files managed by the security software. This type of vulnerability aligns with CWE-264, which addresses permissions, privileges, and access control issues, particularly when security software inadvertently grants unauthorized access to system configuration functions. The unspecified vectors suggest that the vulnerability may involve multiple attack surfaces including process injection, file system manipulation, or registry key modification within the Mac OS X security framework.
The operational impact of this vulnerability extends beyond simple firewall disabling, as it fundamentally compromises the security architecture of affected systems. When the Mac OS X firewall is disabled, systems become vulnerable to various network-based attacks including port scanning, unauthorized access attempts, and potential exploitation of other system vulnerabilities. This creates a cascading security risk where the compromise of one protective layer enables further exploitation of the system. The vulnerability affects all users running affected versions of F-Secure products, regardless of whether they are actively using the security software, as the flaw exists within the system integration layer that manages firewall state. This represents a significant concern for enterprise environments where Mac systems may be running outdated security software, potentially exposing entire networks to lateral movement by attackers who have already gained access to individual endpoints.
Organizations and individual users should immediately update to F-Secure versions 11500 or later to remediate this vulnerability. System administrators should conduct comprehensive inventory checks to identify all affected Mac systems within their networks and implement immediate patching procedures. The mitigation strategy should include monitoring for unauthorized firewall changes and implementing additional network security controls to compensate for the reduced protection. This vulnerability also highlights the importance of proper security software integration testing and the need for security vendors to maintain robust security practices throughout their product lifecycle. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and defense evasion, specifically targeting the system configuration and network protection components that are essential for maintaining secure operational environments.