Vulnerability CVE-2018-4170


Published: 2018-04-03

Description:
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Admin Framework" component. It allows local users to discover a password by listing a process and its arguments during sysadminctl execution.

Type:

CWE-255

(Credentials Management)

Vendor: Apple
Product: Mac os x 
Version:
10.9.5
10.9.4
10.9.3
10.9.2
10.9.1
10.9
10.8.5
10.8.4
10.8.3
10.8.2
10.8.1
10.8.0
10.7.5
10.7.4
10.7.3
10.7.2
10.7.1
10.7.0
10.6.8
10.6.7
10.6.6
10.6.5
10.6.4
10.6.3
10.6.2
10.6.1
10.6.0
10.5.8
10.5.7
10.5.6
10.5.5
10.5.4
10.5.3
10.5.2
10.5.1
10.5.0
10.5
10.4.9
10.4.8
10.4.7
10.4.6
10.4.5
10.4.4
10.4.3
10.4.2
10.4.11
10.4.10
10.4.1
10.4.0
10.4
10.3.9
10.3.8
10.3.7
10.3.6
10.3.5
10.3.4
10.3.3
10.3.2
10.3.1
10.3.0
10.3
10.2.8
10.2.7
10.2.6
10.2.5
10.2.4
10.2.3
10.2.2
10.2.1
10.2.0
10.2
10.13.0
10.12.6
10.12.5
10.12.4
10.12.3
10.12.2
10.12.1
10.12.0
10.11.6
10.11.5
10.11.4
10.11.3
10.11.2
10.11.1
10.11.0
10.10.5
10.10.4
10.10.3
10.10.2
10.10.1
10.10.0
10.1.5
10.1.4
10.1.3
10.1.2
10.1.1
10.1.0
10.1
10.0.4
See more versions on NVD

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.securityfocus.com/bid/103582
http://www.securitytracker.com/id/1040608
https://support.apple.com/HT208692

Related CVE
CVE-2018-8897
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that ...
CVE-2018-4173
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Status Bar" component. It allows invisible microphone access via a crafted app.
CVE-2018-4176
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Disk Images" component. It allows attackers to trigger an app launch upon mounting a crafted disk image.
CVE-2018-4175
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "LaunchServices" component. It allows attackers to bypass the code-signing protection mechanism via a crafted app.
CVE-2018-4174
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It allows man-in-the-middle attackers to read S/MIME encrypted messages by leveraging an incons...
CVE-2018-4172
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Find My iPhone" component. It allows physically proximate attackers to bypass the iCloud password requirement for disabling the "Find My iPhone" f...
CVE-2018-4168
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a lo...
CVE-2018-4167
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "File System Events" component. A race condition al...

Copyright 2018, cxsecurity.com

 

Back to Top