VAR-200407-0076
Vulnerability from variot - Updated: 2025-04-03 20:13Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field. There is a buffer overflow vulnerability in the way Apple's AppleFileServer handles certain authentication requests. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code. apple's Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. The issue presents itself when the application receives a 'LoginExt' packet containing a malformed 'PathName' argument. This issue was previously disclosed in a multiple BID 10268 (Apple OS X Multiple Unspecified Large Input Vulnerabilities), however, it is being assigned a new BID as a result of new information available. The problem exists in the pre-authentication stage. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
@stake, Inc.
www.atstake.com
Security Advisory
Advisory Name: AppleFileServer Remote Command Execution Release Date: 05/03/2004 Application: AppleFileServer Platform: MacOS X 10.3.3 and below Severity: A remote attacker can execute arbitrary commands as root Authors: Dave G. daveg@atstake.com Dino Dai Zovi ddaizovi@atstake.com Vendor Status: Informed, Upgrade Available CVE Candidate: CAN-2004-0430 Reference: www.atstake.com/research/advisories/2004/a050304-1.txt
Overview:
The AppleFileServer provides Apple Filing Protocol (AFP) services for both Mac OS X and Mac OS X server. AFP is a protocol used to remotely mount drives, similar to NFS or SMB/CIFS. AFP is a protocol used to remotely mount drives, similar to NFS or SMB/CIFS. AFP is not enabled by default. It is enabled through the Sharing Preferences section by selecting the 'Personal File Sharing' checkbox.
Thereis a pre-authentication remotely exploitable stack buffer overflow that allows an attacker to obtain administrative privileges. The PathName argument is encoded as one-byte specifying the string type, two-bytes specifying the string length, and finally the string itself. A string of type AFPName (0x3) that is longer than the length declared in the packet will overflow the fixed-size stack buffer.
The previously described malformed request results in a trivially exploitable stack buffer overflow.
Vendor Response:
- From APPLE-SA-2004-05-03 Security Update 2004-05-03
AppleFileServer: Fixes CAN-2004-0430 to improve the handling of long passwords. Credit to Dave G. from @stake for reporting this issue.
Security Update 2004-05-03 may be obtained from:
-
Software Update pane in System Preferences
-
Apple's Software Downloads web site:
For Mac OS X 10.3.3 "Panther"
http://download.info.apple.com/Mac_OS_X/061-1213.20040503.vngr3/ 2Z/SecUpd2004-05-03Pan.dmg The download file is named: "SecUpd2004-05-03Pan.dmg" Its SHA-1 digest is: 6f35539668d80ee536305a4146bd982a93706532
For Mac OS X Server 10.3.3
http://download.info.apple.com/Mac_OS_X/061-1215.20040503.mPp9k/ 2Z/SecUpdSrvr2004-05-03Pan.dmg The download file is named: "SecUpdSrvr2004-05-03Pan.dmg" Its SHA-1 digest is: 3c7da910601fd36d4cdfb276af4783ae311ac5d7
For Mac OS X 10.2.8 "Jaguar"
http://download.info.apple.com/Mac_OS_X/061-1217.20040503.BmkY5/ 2Z/SecUpd2004-05-03Jag.dmg The download file is named: "SecUpd2004-05-03Jag.dmg" Its SHA-1 digest is: 11d5f365e0db58b369d85aa909ac6209e2f49945
For Mac OS X Server 10.2.8
http://download.info.apple.com/Mac_OS_X/061-1219.20040503.Zsw3S/ 2Z/SecUpdSrvr2004-05-03Jag.dmg The download file is named: "SecUpdSrvr2004-05-03Jag.dmg" Its SHA-1 digest is: 28859a4c88f6e1d1fe253388b233a5732b6e42fb
Timeline
3/26/2004 Vendor notified of issue 5/04/2004 Vendor informs us that they have a patch available 4/04/2004 Advisory released
Recommendation:
If you do not need AFS, disable it. If you do need it, upgrade to the latest version of Panther.
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned the following names to these issues. These are candidates for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
CAN-2004-0430 AppleFileServer Remote Command Execution
Open Source Vulnerability Database (OSVDB) Information: More information available at www.osvdb.org
OSVDB ID 5762
@stake Vulnerability Reporting Policy: http://www.atstake.com/research/policy/
@stake Advisory Archive: http://www.atstake.com/research/advisories/
PGP Key: http://www.atstake.com/research/pgp_key.asc
Copyright 2004 @stake, Inc. All rights reserved.
-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3
iQA/AwUBQJbHKUe9kNIfAm4yEQJraQCgvzJSUEBfxJNS5Yrk8tCFoM+7vCsAn0WI aBZDr4XgtWYb05rrBQKn01f2 =A6ex -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200407-0076",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x server",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "mac os x",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple computer",
"version": null
},
{
"model": "apple mac os x",
"scope": "lte",
"trust": 0.8,
"vendor": "\u30a2\u30c3\u30d7\u30eb",
"version": "10.3.3 and earlier"
},
{
"model": "apple mac os x",
"scope": "lte",
"trust": 0.8,
"vendor": "\u30a2\u30c3\u30d7\u30eb",
"version": "server 10.3.3 and earlier"
},
{
"model": "apple mac os x server",
"scope": "lte",
"trust": 0.8,
"vendor": "\u30a2\u30c3\u30d7\u30eb",
"version": "10.3.3 and earlier"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "BID",
"id": "10271"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dave G\u203b daveg@atstake.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
}
],
"trust": 0.6
},
"cve": "CVE-2004-0430",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CVE-2004-0430",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "VHN-8860",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2004-0430",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#648406",
"trust": 0.8,
"value": "27.42"
},
{
"author": "NVD",
"id": "CVE-2004-0430",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200407-024",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-8860",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "VULHUB",
"id": "VHN-8860"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field. There is a buffer overflow vulnerability in the way Apple\u0027s AppleFileServer handles certain authentication requests. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code. apple\u0027s Apple Mac OS X and Apple Mac OS X Server Exists in unspecified vulnerabilities.None. The issue presents itself when the application receives a \u0027LoginExt\u0027 packet containing a malformed \u0027PathName\u0027 argument. \nThis issue was previously disclosed in a multiple BID 10268 (Apple OS X Multiple Unspecified Large Input Vulnerabilities), however, it is being assigned a new BID as a result of new information available. The problem exists in the pre-authentication stage. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n\n\n @stake, Inc. \n www.atstake.com\n\n Security Advisory\n\nAdvisory Name: AppleFileServer Remote Command Execution\n Release Date: 05/03/2004\n Application: AppleFileServer\n Platform: MacOS X 10.3.3 and below\n Severity: A remote attacker can execute arbitrary\n commands as root\n Authors: Dave G. \u003cdaveg@atstake.com\u003e\n Dino Dai Zovi \u003cddaizovi@atstake.com\u003e\nVendor Status: Informed, Upgrade Available\nCVE Candidate: CAN-2004-0430\n Reference: www.atstake.com/research/advisories/2004/a050304-1.txt\n\n\nOverview:\n\nThe AppleFileServer provides Apple Filing Protocol (AFP) services for\nboth Mac OS X and Mac OS X server. AFP is a protocol used to\nremotely mount drives, similar to NFS or SMB/CIFS. AFP is a protocol used to\nremotely mount drives, similar to NFS or SMB/CIFS. AFP is not\nenabled by default. It is enabled through the Sharing Preferences\nsection by selecting the \u0027Personal File Sharing\u0027 checkbox. \n\nThereis a pre-authentication remotely exploitable stack buffer\noverflow that allows an attacker to obtain administrative\nprivileges. The PathName argument\nis encoded as one-byte specifying the string type, two-bytes\nspecifying the string length, and finally the string itself. A\nstring of type AFPName (0x3) that is longer than the length declared\nin the packet will overflow the fixed-size stack buffer. \n\nThe previously described malformed request results in a trivially\nexploitable stack buffer overflow. \n\n\nVendor Response:\n\n- From APPLE-SA-2004-05-03 Security Update 2004-05-03\n\nAppleFileServer: Fixes CAN-2004-0430 to improve the handling of long\npasswords. Credit to Dave G. from @stake for reporting this issue. \n\nSecurity Update 2004-05-03 may be obtained from:\n\n * Software Update pane in System Preferences\n\n * Apple\u0027s Software Downloads web site:\n\n For Mac OS X 10.3.3 \"Panther\"\n =============================\n http://download.info.apple.com/Mac_OS_X/061-1213.20040503.vngr3/\n2Z/SecUpd2004-05-03Pan.dmg\n The download file is named: \"SecUpd2004-05-03Pan.dmg\"\n Its SHA-1 digest is: 6f35539668d80ee536305a4146bd982a93706532\n \n For Mac OS X Server 10.3.3\n ==========================\n http://download.info.apple.com/Mac_OS_X/061-1215.20040503.mPp9k/\n2Z/SecUpdSrvr2004-05-03Pan.dmg\n The download file is named: \"SecUpdSrvr2004-05-03Pan.dmg\"\n Its SHA-1 digest is: 3c7da910601fd36d4cdfb276af4783ae311ac5d7\n \n For Mac OS X 10.2.8 \"Jaguar\"\n =============================\n http://download.info.apple.com/Mac_OS_X/061-1217.20040503.BmkY5/\n2Z/SecUpd2004-05-03Jag.dmg\n The download file is named: \"SecUpd2004-05-03Jag.dmg\"\n Its SHA-1 digest is: 11d5f365e0db58b369d85aa909ac6209e2f49945\n \n For Mac OS X Server 10.2.8\n ==========================\n http://download.info.apple.com/Mac_OS_X/061-1219.20040503.Zsw3S/\n2Z/SecUpdSrvr2004-05-03Jag.dmg\n The download file is named: \"SecUpdSrvr2004-05-03Jag.dmg\"\n Its SHA-1 digest is: 28859a4c88f6e1d1fe253388b233a5732b6e42fb\n\n\nTimeline\n\n3/26/2004 Vendor notified of issue\n5/04/2004 Vendor informs us that they have a patch available\n4/04/2004 Advisory released\n\n\nRecommendation:\n\nIf you do not need AFS, disable it. If you do need it, upgrade to\nthe latest version of Panther. \n\n\nCommon Vulnerabilities and Exposures (CVE) Information:\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned\nthe following names to these issues. These are candidates for\ninclusion in the CVE list (http://cve.mitre.org), which standardizes\nnames for security problems. \n\n CAN-2004-0430 AppleFileServer Remote Command Execution\n\n\nOpen Source Vulnerability Database (OSVDB) Information:\nMore information available at www.osvdb.org\n\n OSVDB ID 5762\n\n\n@stake Vulnerability Reporting Policy:\nhttp://www.atstake.com/research/policy/\n\n@stake Advisory Archive:\nhttp://www.atstake.com/research/advisories/\n\nPGP Key:\nhttp://www.atstake.com/research/pgp_key.asc\n\nCopyright 2004 @stake, Inc. All rights reserved. \n\n\n\n\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: PGP 8.0.3\n\niQA/AwUBQJbHKUe9kNIfAm4yEQJraQCgvzJSUEBfxJNS5Yrk8tCFoM+7vCsAn0WI\naBZDr4XgtWYb05rrBQKn01f2\n=A6ex\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0430"
},
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "BID",
"id": "10271"
},
{
"db": "VULHUB",
"id": "VHN-8860"
},
{
"db": "PACKETSTORM",
"id": "33249"
}
],
"trust": 2.79
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-8860",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8860"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-0430",
"trust": 3.7
},
{
"db": "SECTRACK",
"id": "1010039",
"trust": 3.3
},
{
"db": "SECUNIA",
"id": "11539",
"trust": 3.3
},
{
"db": "CERT/CC",
"id": "VU#648406",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024",
"trust": 0.7
},
{
"db": "ATSTAKE",
"id": "A050304-1",
"trust": 0.6
},
{
"db": "XF",
"id": "16049",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2004-05-03",
"trust": 0.6
},
{
"db": "BID",
"id": "10271",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "33249",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-18023",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-71362",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-66984",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-88766",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-62850",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82304",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "34035",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "391",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "16863",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "9931",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-8860",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "VULHUB",
"id": "VHN-8860"
},
{
"db": "BID",
"id": "10271"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "PACKETSTORM",
"id": "33249"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"id": "VAR-200407-0076",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-8860"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-03T20:13:37.976000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "top page",
"trust": 0.8,
"url": "https://www.apple.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://www.atstake.com/research/advisories/2004/a050304-1.txt"
},
{
"trust": 3.3,
"url": "http://www.securiteam.com/securitynews/5qp0115cuo.html"
},
{
"trust": 2.5,
"url": "http://www.kb.cert.org/vuls/id/648406"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1010039"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/11539"
},
{
"trust": 1.9,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16049"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/mhonarc/security-announce/msg00049.html"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0430"
},
{
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=61798"
},
{
"trust": 0.8,
"url": "http://secunia.com/advisories/11539/"
},
{
"trust": 0.8,
"url": "http://www.securitytracker.com/alerts/2004/may/1010039.html2"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/16049"
},
{
"trust": 0.3,
"url": "http://metasploit.com/projects/framework/exploits.html"
},
{
"trust": 0.3,
"url": "/archive/1/362117"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org),"
},
{
"trust": 0.1,
"url": "http://www.atstake.com/research/advisories/"
},
{
"trust": 0.1,
"url": "http://download.info.apple.com/mac_os_x/061-1213.20040503.vngr3/"
},
{
"trust": 0.1,
"url": "http://www.atstake.com/research/pgp_key.asc"
},
{
"trust": 0.1,
"url": "http://www.atstake.com/research/policy/"
},
{
"trust": 0.1,
"url": "https://www.osvdb.org"
},
{
"trust": 0.1,
"url": "http://download.info.apple.com/mac_os_x/061-1219.20040503.zsw3s/"
},
{
"trust": 0.1,
"url": "http://download.info.apple.com/mac_os_x/061-1215.20040503.mpp9k/"
},
{
"trust": 0.1,
"url": "http://download.info.apple.com/mac_os_x/061-1217.20040503.bmky5/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "VULHUB",
"id": "VHN-8860"
},
{
"db": "BID",
"id": "10271"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "PACKETSTORM",
"id": "33249"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#648406"
},
{
"db": "VULHUB",
"id": "VHN-8860"
},
{
"db": "BID",
"id": "10271"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"db": "PACKETSTORM",
"id": "33249"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-05-07T00:00:00",
"db": "CERT/CC",
"id": "VU#648406"
},
{
"date": "2004-07-07T00:00:00",
"db": "VULHUB",
"id": "VHN-8860"
},
{
"date": "2004-05-03T00:00:00",
"db": "BID",
"id": "10271"
},
{
"date": "2024-06-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"date": "2004-05-07T16:47:14",
"db": "PACKETSTORM",
"id": "33249"
},
{
"date": "2004-05-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"date": "2004-07-07T04:00:00",
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-05-07T00:00:00",
"db": "CERT/CC",
"id": "VU#648406"
},
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-8860"
},
{
"date": "2009-07-12T04:07:00",
"db": "BID",
"id": "10271"
},
{
"date": "2024-06-07T09:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000935"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200407-024"
},
{
"date": "2025-04-03T01:03:51.193000",
"db": "NVD",
"id": "CVE-2004-0430"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Mac OS X AppleFileServer fails to properly handle certain authentication requests",
"sources": [
{
"db": "CERT/CC",
"id": "VU#648406"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Boundary Condition Error",
"sources": [
{
"db": "BID",
"id": "10271"
},
{
"db": "CNNVD",
"id": "CNNVD-200407-024"
}
],
"trust": 0.9
}
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.