Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Mac OS X lets local users create root-writable files

CVE-2005-2713 · published 20 years ago
Summary

In Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5, a user with a normal account could cause the system to create files that anyone can change, and those files are owned by the super‑user (root). This could let the user modify system settings or install malicious software. Upgrade the operating system to 10.3.9, 10.4.5, or later to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple mac_os_x 10.3
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.3.7
10.3.8
10.3.9
10.4
10.4.1
4 more version ranges
cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:*
apple mac_os_x_server 10.3
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.3.7
10.3.8
10.3.9
10.4
10.4.1
4 more version ranges
cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:*
Original advisory text
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbitrary world-writable files as root by specifying an alternate file in the pas...
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbitrary world-writable files as root by specifying an alternate file in the password database option.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.8 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published31 Dec 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-2713 · NVD
Track software like this
Free during beta