CVE-2006-5327

Apple Xcode < 2.2 - Untrusted Search Path Code Execution via PATH Environment Variable

Title source: manual
STIX 2.1

Description

Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.

References (12)

Core 12
Core References
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22390
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4058
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27441
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3665
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4059
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018872
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2007/Oct/msg00001.html
Various Sources x_refsource_misc
http://www.digitalmunition.com/Xcode_OpenBase_pwn.pl
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20562
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29624
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22474

Scores

EPSS 0.0058
EPSS Percentile 44.5%

Details

Status published
Products (5)
apple/xcode < 2.2
openbase_international_ltd/openbase 7.0.15
openbase_international_ltd/openbase 8.0.4
openbase_international_ltd/openbase 9.1.5
openbase_international_ltd/openbase < 10.0
Published Oct 17, 2006
Tracked Since Feb 18, 2026