CVE-2003-0703

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

KisMAC before 0.05d trusts user-supplied variables to load arbitrary kernels or kernel modules, which allows local users to gain privileges via the $DRIVER_KEXT environment variable as used in (1) viha_driver.sh, (2) macjack_load.sh, or (3) airojack_load.sh, or (4) via "similar techniques" using exchangeKernel.sh.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.atstake.com/research/advisories/2003/a082203-1.txtPatch, Vendor Advisory
http://www.securityfocus.com/bid/8497Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13007
https://exchange.xforce.ibmcloud.com/vulnerabilities/13008
http://www.atstake.com/research/advisories/2003/a082203-1.txtPatch, Vendor Advisory
http://www.securityfocus.com/bid/8497Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13007
https://exchange.xforce.ibmcloud.com/vulnerabilities/13008

Timeline

Published: Sep 17, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-07047.2KisMAC before 0.05d trusts user-supplied variables when chown'ing files or directories, which allows local users to gain privileges via the CVE-2003-07057.5Buffer overflow in mah-jong 1.5.6 and earlier allows remote attackers to execute arbitrary code.CVE-2003-07065.0Unknown vulnerability in mah-jong 1.5.6 and earlier allows remote attackers to cause a denial of service (tight loop).CVE-2003-07077.5Buffer overflow in LinuxNode (node) before 0.3.2 allows remote attackers to execute arbitrary code.CVE-2003-07087.5Format string vulnerability in LinuxNode (node) before 0.3.2 may allow attackers to cause a denial of service or execute arbitrary code.CVE-2003-07097.5Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to exe CVE-2003-07117.5Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remo CVE-2003-07124.3Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web CVE-2003-07147.5The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) CVE-2003-071510.0Heap-based buffer overflow in the Distributed Component Object Model (DCOM) interface in the RPCSS Service allows remote attackers to execut CVE-2003-07177.5The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers t CVE-2003-07185.0The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (m