Quantum Secular Labs / Blog / Advisories

CVE-2003-1009: Apple Mac OS X: Privilege escalation

CVE-2003-1009 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Apple Mac OS X. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Directory Services in Apple Mac OS X 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server 10.2 through 10.3.2 accepts authentication server information from unknown LDAP or NetInfo sources as provided by a malicious DHCP server, which allows remote attackers to gain privileges.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

• Access vector: Network. Exploitable remotely over the network.
• Access complexity: Low. No special conditions are required.
• Authentication: None. No authentication is needed.
• Confidentiality impact: Complete. Total information disclosure.
• Integrity impact: Complete. Total loss of integrity.
• Availability impact: Complete. Total shutdown of the component.

Affected products

• Apple Mac OS X: 10.0.2; 10.0.3; 10.2.8; 10.3.2
• Apple Mac OS X Server: 10.2; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; 10.2.6; 10.2.7; 10.2.8; 10.3; 10.3.1; 10.3.2

References

• http://docs.info.apple.com/article.html?artnum=61798
• http://www.securityfocus.com/bid/9110
• http://docs.info.apple.com/article.html?artnum=32478
• http://www.carrel.org/dhcp-vuln.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13874