Description
OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.
References
- 22390 third-party-advisory
- 27441 third-party-advisory
- ADV-2007-3665 vdb-entry
- 1018872 vdb-entry
- APPLE-SA-2007-10-30 vendor-advisory
- 20562 vdb-entry
- http://www.digitalmunition.com/DMA%5B2006-1016a%5D.txt
- http://www.digitalmunition.com/Xcode_OpenBase_createfile.pl