CVE-2003-1009

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Directory Services in Apple Mac OS X 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server 10.2 through 10.3.2 accepts authentication server information from unknown LDAP or NetInfo sources as provided by a malicious DHCP server, which allows remote attackers to gain privileges.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.info.apple.com/article.html?artnum=32478
http://docs.info.apple.com/article.html?artnum=61798Patch, Vendor Advisory
http://www.carrel.org/dhcp-vuln.html
http://www.securityfocus.com/bid/9110Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13874
http://docs.info.apple.com/article.html?artnum=32478
http://docs.info.apple.com/article.html?artnum=61798Patch, Vendor Advisory
http://www.carrel.org/dhcp-vuln.html
http://www.securityfocus.com/bid/9110Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13874

Timeline

Published: Mar 29, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-10104.6Unknown vulnerability in fs_usage in Mac OS X 10.2.8 and 10.3.2 and Mac OS X Server 10.2.8 and 10.3.2 allows local users to gain privileges CVE-2003-10117.2Apple Mac OS X 10.0 through 10.2.8 allows local users with a USB keyboard to gain unauthorized access by holding down the CTRL and C keys wh CVE-2003-10125.0The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a CVE-2003-10137.5The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q CVE-2003-10147.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use mu CVE-2003-10157.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use wh CVE-2003-10167.5Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use ma CVE-2003-10175.0Macromedia Flash Player before 7,0,19,0 stores a Flash data file in a predictable location that is accessible to web browsers such as Intern CVE-2003-10187.2Format string vulnerability in enq command in AIX 4.3, 5.1, and 5.2 allows local users with rintq group privileges to gain privileges via un CVE-2003-10205.0The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial of service (crash).CVE-2003-10217.2The scosession program in OpenServer 5.0.6 and 5.0.7 allows local users to gain privileges via crafted strings on the commandline.CVE-2003-10227.5Directory traversal vulnerability in fsp before 2.81.b18 allows remote users to access files outside the FSP root directory.