CVE-2013-3951

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

sys/openbsd/stack_protector.c in libc in Apple iOS 6.1.3 and Mac OS X 10.8.x does not properly parse the Apple strings employed in the user-space stack-cookie implementation, which allows local users to bypass cookie randomization by executing a program with a call-path beginning with the stack-guard= substring, as demonstrated by an iOS untethering attack or an attack against a setuid Mac OS X program.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdfExploit
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor Advisory
http://www.securitytracker.com/id/1033703
http://www.syscan.org/index.php/sg/program/day/2
https://support.apple.com/HT205212Vendor Advisory
https://support.apple.com/HT205213Vendor Advisory
https://support.apple.com/HT205267Vendor Advisory
http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdfExploit
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor Advisory
http://www.securitytracker.com/id/1033703
http://www.syscan.org/index.php/sg/program/day/2
https://support.apple.com/HT205212Vendor Advisory
https://support.apple.com/HT205213Vendor Advisory
https://support.apple.com/HT205267Vendor Advisory

Timeline

Published: Jun 5, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-39522.1The fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protecti CVE-2013-39534.9The mach_port_space_info function in osfmk/ipc/mach_debug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structu CVE-2013-39546.9The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions CVE-2013-39556.2The get_xattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of CVE-2013-39567.2The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP5 on Windows XP and Windows Server 2003; Novell Client 2 SP2 on Windows Vista an CVE-2013-39577.5SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 a CVE-2013-39587.5The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other pr CVE-2013-39594.0The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different b CVE-2013-39609.9Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass CVE-2013-39616.5SQL injection vulnerability in edit_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated users to execute arbitrary SQL c CVE-2013-39624.3Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV36 CVE-2013-39636.8Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, G