Vulnerability Description
Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Xcode | <= 2.2 |
| Openbase International Ltd | Openbase | <= 10.0 |
References
- http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html
- http://secunia.com/advisories/22390PatchVendor Advisory
- http://secunia.com/advisories/22474PatchVendor Advisory
- http://secunia.com/advisories/27441
- http://www.digitalmunition.com/DMA%5B2006-1016a%5D.txt
- http://www.digitalmunition.com/Xcode_OpenBase_pwn.pl
- http://www.securityfocus.com/bid/20562Exploit
- http://www.securitytracker.com/id?1018872
- http://www.vupen.com/english/advisories/2006/4058
- http://www.vupen.com/english/advisories/2006/4059
- http://www.vupen.com/english/advisories/2007/3665
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29624
- http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html
- http://secunia.com/advisories/22390PatchVendor Advisory
- http://secunia.com/advisories/22474PatchVendor Advisory
FAQ
What is CVE-2006-5327?
CVE-2006-5327 is a vulnerability with a CVSS score of 7.2 (HIGH). Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modifie...
How severe is CVE-2006-5327?
CVE-2006-5327 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-5327?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Xcode, Openbase International Ltd Openbase.