CVE-2002-0676

Vulnerability

SoftwareUpdate for MacOS 10.1.x does not authenticate the source of software updates, allowing remote attackers to potentially execute arbitrary code. The vulnerability exists because the update process uses HTTP without authentication, and downloaded packages are installed with root privileges [1].

Exploitation

An attacker can exploit this vulnerability by controlling the machine that the vulnerable client believes is the Apple update server, swquery.apple.com. This can be achieved through techniques such as DNS cache poisoning or DNS spoofing. Once the attacker controls the server, they can supply Trojan Horse updates that will be installed on the victim's system [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with root privileges on the vulnerable system. This means an attacker can install malicious software, effectively gaining complete control over the affected MacOS X machine [1].

Mitigation

No specific patched version or release date has been disclosed in the available references. Users are advised to be cautious when downloading software updates. It is not known if this vulnerability is listed on the KEV catalog or if the product is end-of-life [1].