vulnwire
7.5high

CVE-2002-06761 exploit

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execu…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.3%
percentile 91%
Public exploits
1
Exploit-DB

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.

Exploit prediction (EPSS)

4.27% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

Exploits and detections

  • EDB-21596 Apple Mac OSX 10.1.x - SoftwareUpdate Arbitrary Package Installation · remote · 2002-07-08

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • osvdb.org /5137 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/5176 · vdb-entry, x_refsource_BID, x_transferred
  • cunap.com /~hardingr/projects/osx/exploit.html · x_refsource_MISC, x_transferred
  • iss.net /security_center/static/9502.php · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.