CVE-2018-4369

Vulnerability

A logic issue in the state management of the Apple File Protocol (AFP) server (afpserver) allows a remote attacker to attack AFP servers through HTTP clients. The vulnerability affects macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and macOS Mojave 10.14.1, as well as iOS versions prior to 12.1, tvOS prior to 12.1, and watchOS prior to 5.1 [1][2][3][4]. The issue was addressed with improved state management.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to an AFP server. No authentication is required, as the attack is remote and can be performed over the network. The exact sequence of steps is not disclosed, but the attack vector is through HTTP clients targeting the afpserver component.

Impact

Successful exploitation allows a remote attacker to compromise AFP servers, potentially leading to unauthorized access or disruption of file sharing services. The impact is limited to the AFP server process, but could allow further attacks on the network.

Mitigation

Apple released fixes on October 30, 2018, in macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra, iOS 12.1, tvOS 12.1, and watchOS 5.1 [1][2][3][4]. Users should update to the latest versions. No workarounds are provided.