CVE-2002-0676

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

4.27% chance of exploitation in the next 30 days, 90th percentile

Published

2003-04-02

Updated

2024-08-08

Proof-of-concept exploits (1)

• http://www.cunap.com/~hardingr/projects/osx/exploit.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/21596

References

• CVE Record
• NVD entry

Related

• CVE-2002-0665
• CVE-2002-0680
• CVE-2002-0661
• CVE-2002-0681
• CVE-2002-0659
• CVE-2002-0682