Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Mac OS X Alias Manager lets users gain rights, crash

CVE-2008-2308 · published 18 years ago
Summary

The Alias Manager component in Mac OS X 10.5.1 and earlier for Intel computers can be tricked into handling specially crafted file shortcuts, which may let a local user increase their access level or cause the application to stop working. This could lead to unauthorized actions or interruptions for anyone using the affected Mac. Install the latest Apple security updates or upgrade to a newer version of Mac OS X to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple mac_os_x 10.4.1
10.4.2
10.4.3
10.4.4
10.4.5
10.4.6
10.4.7
10.4.8
10.4.9
10.4.10
10.4.11
10.5
1 more version range
cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*
apple mac_os_x_server 10.4.1
10.4.2
10.4.3
10.4.4
10.4.5
10.4.6
10.4.7
10.4.8
10.4.9
10.5
10.5.1
cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service (memory corruption and applicat...
Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service (memory corruption and application crash) by resolving an alias that contains crafted AFP volume mount information.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published1 Jul 2008
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-2308 · NVD
Track software like this
Free during beta