VULNERABILITY INTELLIGENCE

CVE-2008-3438

CVSS score8.1 HIGH
EPSS probability0.83%
CISA KEVNot currently listed
Published2008-08-01
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

Weakness classification

  • CWE-494: Download of Code Without Integrity Check

Primary references