CVE-2003-0877: Medium severity Apple iOS and macOS vulnerability
Mac OS X before 10.3 with core files enabled allows local users to overwrite arbitrary files and read core files via a symlink attack on core files that are created with predictable names in the /cores directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On affected Mac OS X systems (Mac OS X before 10.3 where core files are enabled), disable core file generation or stop writing core dumps to /cores. For example, set the system core file size limit to 0 or configure the OS so cores are not created in /cores.
Mac OS X core file generation (core dumps to /cores) = disabled - Compensating control
On affected Mac OS X systems (Mac OS X before 10.3), restrict creation and modification of files in /cores: change ownership to root, remove write permissions for unprivileged/local users, and set directory permissions (and sticky bit) so non-privileged users cannot create or replace files or symlinks in /cores to prevent predictable-name symlink attacks.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0877?
CVE-2003-0877 is classified as a moderate severity vulnerability.
How do I fix CVE-2003-0877?
To fix CVE-2003-0877, you should upgrade to Mac OS X version 10.3 or later.
Who is affected by CVE-2003-0877?
CVE-2003-0877 affects local users of Mac OS X versions prior to 10.3.
What kind of attack does CVE-2003-0877 allow?
CVE-2003-0877 allows for a symlink attack that can overwrite arbitrary files.
Why is CVE-2003-0877 a risk?
CVE-2003-0877 poses a risk because it can lead to unauthorized access to core files.