CVE-2007-4685: High severity Apple iOS and macOS vulnerability

Published Nov 15, 2007

Updated

The kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to gain privileges by executing setuid or setgid programs in which the stdio, stderr, or stdout file descriptors are "in an unexpected state."

Affected Software

20 affected components

Apple iOS and macOS=10.4.3

Apple Mac OS X Server=10.4.3

Apple Mac OS X Server=10.4.10

Apple Mac OS X Server=10.4.9

Apple iOS and macOS=10.4.1

Apple Mac OS X Server=10.4.2

Apple Mac OS X Server=10.4.4

Apple iOS and macOS=10.4.10

Apple Mac OS X Server=10.4.1

Apple iOS and macOS=10.4.9

Apple iOS and macOS=10.4.7

Apple iOS and macOS=10.4.4

Apple Mac OS X Server=10.4.5

Apple Mac OS X Server=10.4.6

Apple Mac OS X Server=10.4.8

Apple iOS and macOS=10.4.6

Apple iOS and macOS=10.4.5

Apple iOS and macOS=10.4.8

Apple Mac OS X Server=10.4.7

Apple iOS and macOS=10.4.2

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html

Event History

Nov 15, 2007

CVE Published

01:46 AM

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4685?

CVE-2007-4685 has a medium severity level as it allows local users to gain elevated privileges.

How do I fix CVE-2007-4685?

To mitigate CVE-2007-4685, users should update their Apple Mac OS X to a version later than 10.4.10 where the vulnerability has been addressed.

Who is affected by CVE-2007-4685?

CVE-2007-4685 affects local users of Apple Mac OS X versions 10.4 through 10.4.10.

What types of programs are involved in CVE-2007-4685?

CVE-2007-4685 involves setuid or setgid programs that can be exploited due to their standard input/output file descriptors being in an unexpected state.

Is there a workaround for CVE-2007-4685?

There is no specific workaround for CVE-2007-4685 other than upgrading to the secure versions of Mac OS X.