{"vuid":"VU#708340","idnumber":"708340","name":"Apple Mac OS X AFP server may disclose file and folder information in search results","keywords":["Apple","Mac OS X","AFP server","information disclosure","file","folder","search results","apple-2006-004"],"overview":"A vulnerability in the Apple Mac OS X AFP server may disclose file and folder items to unauthorized users.","clean_desc":"The AFP (Apple Filing Protocol) service allows Apple Mac OS clients to remotely access files stored on a server. When file sharing is enabled, Apple's Mac OS X AFP server allows search results to include files and folders for which the user performing the search does not have access. This vulnerability results in information disclosure if the folders, file names, or file contents contain sensitive information and the user permissions for these files or folders are not configured correctly. Any Apple Mac OS X system with AFP server enabled is vulnerable, however AFP server is not enabled by default on Apple Mac OS X.","impact":"An unauthorized user may be able to view sensitive information in folder and file names as well as gain access to files and folders without proper access permissions set.","resolution":"Apply an update Apple has addressed this issue in Security Update 2006-004 for Apple Mac OS X 10.3.9 by ensuring that search results only contain items for which the user has authorized access. This vulnerability in Apple Mac OS X v10.4 was addressed in Apple Mac OS X v10.4.7.","workarounds":"Workarounds Disable file sharing if it is not needed. File sharing can be disabled in the sharing section of system preferences.","sysaffected":"","thanks":"Thanks to Apple Product Security for reporting this vulnerability.","author":"This document was written by Katie Steiner.","public":["http://docs.info.apple.com/article.html?artnum=304063","http://secunia.com/advisories/21253/"],"cveids":["CVE-2006-1472"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-08-02T12:47:28Z","publicdate":"2006-08-01T00:00:00Z","datefirstpublished":"2007-01-29T13:16:53Z","dateupdated":"2007-01-29T13:17:04Z","revision":28,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":0.0,"vulnote":null}