CVE-2005-0125

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to (1) delete arbitrary files via atrm, (2) execute arbitrary programs via the -f argument to batch, or (3) read arbitrary files via the -f argument to batch, which generates a job file that is readable by the local user.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.htmlPatch, Vendor Advisory
http://marc.info/?l=bugtraq&m=110685027017411&w=2
http://www.digitalmunition.com/DMA%5B2005-0127a%5D.txt
http://www.kb.cert.org/vuls/id/678150Patch, Third Party Advisory, US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/18981
http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.htmlPatch, Vendor Advisory
http://marc.info/?l=bugtraq&m=110685027017411&w=2
http://www.digitalmunition.com/DMA%5B2005-0127a%5D.txt
http://www.kb.cert.org/vuls/id/678150Patch, Third Party Advisory, US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/18981

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-01267.5ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.CVE-2005-01275.0Mail in Mac OS X 10.3.7, when generating a Message-ID header, generates a GUUID that includes information that identifies the Ethernet hardw CVE-2005-01297.5The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" var CVE-2005-01307.5Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names CVE-2005-01315.0The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided CVE-2005-01335.0ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.CVE-2005-01344.6The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hij CVE-2005-01352.1The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of serv CVE-2005-01362.1The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of se CVE-2005-01372.1Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium syscall table entry.CVE-2005-01387.5rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose host CVE-2005-01397.5Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly expo