CVE-2003-0466: apple mac_os_x Off-by-one Error

CVSS: 10.0v2.0HighModified

AliasesDSA-357

Published 01-08-2003Last modified 08-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2003-0466 is a high (CVSS 10.0) Off-by-one Error vulnerability in apple mac_os_x. EPSS estimates a 78.11% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 7 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

78.11%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits7reference, exploit-database

Timeline

01-08-2003
PublishedVulnerability first disclosed.
08-08-2024
Last modifiedVulnerability information updated.

Description

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

CVSS metrics

2 scores · 1 source · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

78.11%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 78.11% on 18-09-2026

18-09-202618-10-2026

EPSS score

78.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

7 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
exploit-databaseremotefreebsdVerified
FreeBSD 4.8 - 'realpath()' Off-by-One Buffer Overflow
Maturity: weaponized

Show all 7 exploits

exploit-databaseremotelinuxVerified
WU-FTPD 2.6.2 - Off-by-One Remote Command Execution
Maturity: weaponized
exploit-databaseremotelinuxVerified
WU-FTPD 2.6.2 - Remote Command Execution
Maturity: weaponized
exploit-databaseremoteunixVerified
WU-FTPD 2.6.0/2.6.1/2.6.2 - 'realpath()' Off-by-One Buffer Overflow
Maturity: weaponized
exploit-databaseremoteunixVerified
WU-FTPD 2.6.2 - 'realpath()' Off-by-One Buffer Overflow
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected systems

Apple2 products

mac_os_x10.2.6
mac_os_x_server10.2.6

Debian1 product

wu-ftpd< 2.6.2-3woody1

Freebsd1 product

freebsd≥ 4.0, ≤ 5.0

Netbsd1 product

netbsd≥ 1.5, ≤ 1.6.1

Openbsd1 product

openbsd≥ 2.0, ≤ 3.3

Redhat1 product

wu_ftpd2.6.1-16

Sun1 product

solaris9.0

Wuftpd1 product

wu-ftpd≥ 2.5.0, ≤ 2.6.2

8 vendors · 9 products

References

26 links

marc.info?l=bugtraq&m=106002488209129&w=2Mailing ListX Refsource BUGTRAQ
isec.pl/vulnerabilities/isec-0011-wu-ftpd.txtX Refsource MISCBroken Link
secunia.com/advisories/9446Third Party AdvisoryX Refsource SECUNIABroken Link
www.osvdb.org/6602VDB EntryX Refsource OSVDBBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1970VDB EntrySignatureX Refsource OVALBroken Link
www.securityfocus.com/archive/1/424852/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/8315VDB EntryX Refsource BIDBroken LinkExploitPatchThird Party AdvisoryVendor Advisory
secunia.com/advisories/9423Third Party AdvisoryX Refsource SECUNIABroken Link
marc.info?l=bugtraq&m=105967301604815&w=2Mailing ListX Refsource BUGTRAQ
archives.neohapsis.com/archives/vulnwatch/2003-q3/0065.htmlMailing ListX Refsource VULNWATCHBroken LinkExploitVendor Advisory

Show all 26 references

download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-019-01Vendor AdvisoryX Refsource IMMUNIXBroken Link
www.redhat.com/support/errata/RHSA-2003-246.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.securityfocus.com/archive/1/425061/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.kb.cert.org/vuls/id/743092Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.redhat.com/support/errata/RHSA-2003-245.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.novell.com/linux/security/advisories/2003_032_wuftpd.htmlVendor AdvisoryX Refsource SUSEBroken Link
sunsolve.sun.com/search/document.do?assetkey=1-77-1001257.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.debian.org/security/2003/dsa-357Vendor AdvisoryX Refsource DEBIANBroken Link
marc.info?l=bugtraq&m=106001702232325&w=2Mailing ListX Refsource BUGTRAQ
securitytracker.com/id?1007380VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.mandriva.com/security/advisories?name=MDKSA-2003:080Vendor AdvisoryX Refsource MANDRAKEThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/12785VDB EntryX Refsource XFThird Party Advisory
marc.info?l=bugtraq&m=106001410028809&w=2Vendor AdvisoryX Refsource FREEBSDMailing List
www.turbolinux.com/security/TLSA-2003-46.txtVendor AdvisoryX Refsource TURBOBroken Link
secunia.com/advisories/9535Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/9447Third Party AdvisoryX Refsource SECUNIABroken Link

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities