National Cyber-Alert System

Vulnerability Summary for CVE-2006-0848

Overview

The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which automatically interprets the script using bash, as demonstrated using a ZIP file that contains a script with a safe file extension.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-053A

Name: TA06-053A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-053A.html

US-CERT Vulnerability Note: VU#999708

Name: VU#999708

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/999708

US-CERT Technical Alert: TA06-062A

Name: TA06-062A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-062A.html

External Source: XF

Name: macosx-zip-command-execution(24808)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24808

External Source: BID

Name: 16736

Hyperlink:http://www.securityfocus.com/bid/16736

External Source: OSVDB

Name: 23510

Hyperlink:http://www.osvdb.org/23510

External Source: MISC

Name: http://www.mathematik.uni-ulm.de/numerik/staff/lehn/macosx.html

Hyperlink:http://www.mathematik.uni-ulm.de/numerik/staff/lehn/macosx.html

External Source: MISC

Name: http://www.heise.de/english/newsticker/news/69862

Hyperlink:http://www.heise.de/english/newsticker/news/69862

External Source: MISC

Name: http://www.frsirt.com/exploits/20060222.safari_safefiles_exec.pm.php

Hyperlink:http://www.frsirt.com/exploits/20060222.safari_safefiles_exec.pm.php

External Source: VUPEN

Name: ADV-2006-0671

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2006/0671

External Source: SECTRACK

Name: 1015652

Hyperlink:http://securitytracker.com/id?1015652

External Source: SECUNIA

Name: 18963

Type: Advisory

Hyperlink:http://secunia.com/advisories/18963

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=303382

Hyperlink:http://docs.info.apple.com/article.html?artnum=303382