NVD Vulnerability Detail

CVE-2017-7149

Summary	An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "StorageKit" component. It allows attackers to discover passwords for APFS encrypted volumes by reading Disk Utility hints, because the stored hint value was accidentally set to the password itself, not the entered hint value.
Publication Date	Oct. 23, 2017, 10:29 a.m.
Registration Date	Jan. 26, 2021, 1:28 p.m.
Last Update	Nov. 21, 2024, 12:31 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::			10.13

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/101178	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/101178	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1039513	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1039513	Third Party Advisory VDB Entry
5	https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79	Exploit Third Party Advisory
6	https://hackernoon.com/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79	Exploit Third Party Advisory
7	https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now/	Exploit Technical Description Third Party Advisory
8	https://nakedsecurity.sophos.com/2017/10/05/urgent-update-your-mac-again-right-now/	Exploit Technical Description Third Party Advisory
9	https://support.apple.com/HT208165	Vendor Advisory
10	https://support.apple.com/HT208165	Vendor Advisory
11	https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/	Exploit Press/Media Coverage Third Party Advisory
12	https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/	Exploit Press/Media Coverage Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Apple macOS の StorageKit コンポーネントにおける暗号化された APFS ボリュームのパスワードを取得される脆弱性

Title	Apple macOS の StorageKit コンポーネントにおける暗号化された APFS ボリュームのパスワードを取得される脆弱性
Summary	Apple macOS の StorageKit コンポーネントは、保存したディスクユーティリティのヒントをパスワードとして設定するため、暗号化された APFS ボリュームのパスワードを取得される脆弱性が存在します。
Possible impacts	攻撃者により、ディスクユーティリティのヒントを読まれることで、暗号化された APFS ボリュームのパスワードを取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 5, 2017, midnight
Registration Date	Nov. 9, 2017, 4:46 p.m.
Last Update	Nov. 9, 2017, 4:46 p.m.

Affected System

アップル

Apple Mac OS X 10.13

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7149	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7149
National Vulnerability Database (NVD)
2	CVE-2017-7149	https://nvd.nist.gov/vuln/detail/CVE-2017-7149

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apple
1	Apple security updates	https://support.apple.com/en-us/HT201222
Apple Security Updates
2	HT208165	https://support.apple.com/en-us/HT208165
Apple セキュリティアップデート
3	HT208165	https://support.apple.com/ja-jp/HT208165

Change Log

No	Changed Details	Date of change
0	[2017年11月09日] 掲載	Feb. 17, 2018, 10:37 a.m.