CVE-2002-0676

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-07-11 · updated 2026-06-16

Description

SoftwareUpdate for MacOS 10.1.x does not use authentication when downloading a software update, which could allow remote attackers to execute arbitrary code by posing as the Apple update server via techniques such as DNS spoofing or cache poisoning, and supplying Trojan Horse updates.

Affected products

macOS: 10.1, 10.1.1, 10.1.2, 10.1.3, 10.1.4, 10.1.5

References

http://www.cunap.com/~hardingr/projects/osx/exploit.html
http://www.iss.net/security_center/static/9502.php
http://www.osvdb.org/5137
http://www.securityfocus.com/bid/5176
http://www.cunap.com/~hardingr/projects/osx/exploit.html
http://www.iss.net/security_center/static/9502.php
http://www.osvdb.org/5137
http://www.securityfocus.com/bid/5176

Get alerted when CVE-2002-0676 or the next vulnerability affects your stack