CVE-2008-0995: Infoleak

Published Mar 18, 2008

Updated

The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods.

Affected Software

2 affected components

Apple Mac OS X Server=10.5.2

Apple iOS and macOS=10.5.2

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

Event History

Mar 18, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0995?

CVE-2008-0995 is classified as a high severity vulnerability due to its potential for enabling brute force attacks on encrypted PDF files.

How do I fix CVE-2008-0995?

To mitigate CVE-2008-0995, upgrade to a newer version of macOS that does not use 40-bit RC4 for PDF file encryption.

What versions of macOS are affected by CVE-2008-0995?

CVE-2008-0995 affects macOS versions specifically 10.5.2, including both Mac OS X and Mac OS X Server.

What kind of attack does CVE-2008-0995 allow?

CVE-2008-0995 allows attackers to potentially decrypt encrypted PDF files using brute force techniques.

Is there a workaround for CVE-2008-0995?

A recommended workaround for CVE-2008-0995 is to avoid using the vulnerable printing feature until a proper update can be applied.