CVE-2003-0171

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2003-05-05 · updated 2026-06-16

Description

DirectoryServices in MacOS X trusts the PATH environment variable to locate and execute the touch command, which allows local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.

Affected products

macOS: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.1 (+10)
Apple Mac Os X Server: 10.0, 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4

References

http://lists.apple.com/mhonarc/security-announce/msg00028.html
http://www.atstake.com/research/advisories/2003/a041003-1.txt
http://lists.apple.com/mhonarc/security-announce/msg00028.html
http://www.atstake.com/research/advisories/2003/a041003-1.txt

Get alerted when CVE-2003-0171 or the next vulnerability affects your stack