CVE-2003-0050

The CVE-2003-0050 issue affects Apple’s Darwin Streaming Administration Server (v4.1.2) and QuickTime Streaming Server (v4.1.1). It stems from parse_xml.cgi, where shell metacharacters injected by an attacker enable remote code execution. Multiple sources (NVD, CVE list, OpenVAS-style advisories)...

CVE-2003-1414

CVE-2003-1414 describes a directory traversal vulnerability in the parse_xml.cgi component of Apple Darwin Streaming Server 4.1.2 and Apple QuickTime Streaming Server 4.1.1. The issue allows remote attackers to read arbitrary files by manipulating the filename parameter. The vulnerability affects...

CVE-2004-1123

CVE-2004-1123 affects Darwin Streaming Server 5.0.1 (and possibly earlier) where a DESCRIBE request containing a null-byte location may crash the server, causing a denial of service. The vulnerability is remote and unauthenticated, leading to a partial availability impact as noted in the CVSS vec...

CVE-2003-0422

CVE-2003-0422 affects Apple QuickTime/Darwin Streaming Server prior to 4.1.3f; a request to /view_broadcast.cgi without required parameters can cause a denial of service (server crash). Remediation: upgrade to 4.1.3f or later (per Rapid7 advisory) to fix this issue.

CVE-2007-0748

The CVE-2007-0748 entry concerns Apple Darwin Streaming Server prior to 5.5.5, where the Darwin Streaming Proxy is vulnerable to a heap-based buffer overflow via multiple trackID values in a SETUP RTSP request. This allows remote code execution with the service’s privileges. A related, separate C...

CVE-2007-0749

Apple Darwin Streaming Proxy contains a stack-based buffer overflow in the is_command() function of proxy.c, exploitable via an overly long cmd or server value in an RTSP request. Affected: Darwin Streaming Server before 5.5.5. Impact: remote code execution with the privileges of the running serv...

CVE-2003-0051

CVE-2003-0051 affects Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1, where parse_xml.cgi can reveal the server installation’s physical path via a NULL file parameter. The issue enables remote access to sensitive path information and is part of a set of re...

CVE-2005-2195

CVE-2005-2195 affects Apple Darwin Streaming Server 5.5 and earlier. An unauthenticated remote attacker can trigger a denial of service by requesting a URL with a .cgi extension containing an MS-DOS device name (for example AUX, CON, PRN, COM1, LPT1) over HTTP port 1220. The issue is a remote DoS...

CVE-2003-0054

CVE-2003-0054 affects Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1. The issue enables remote code execution when an unauthenticated request to port 7070 includes a script argument to the rtsp DESCRIBE method; the script is written to a log file and execu...

CVE-2003-0423

Apple QuickTime/Darwin Streaming Server’s parse_xml.cgi vulnerability (CVE-2003-0423) allows remote access to the source code of files via /parse_xml.cgi?filename=[file] for DS 4.1.3g and earlier. The issue is caused by Web root script disclosure, with no fix available at the time and Apple inves...

CVE-2003-0426

CVE-2003-0426 : In Apple QuickTime/Darwin Streaming Server, prior to 4.1.3f, the HTTP-based admin server presents a Setup Assistant on first install that allows a remote attacker to set the administrator password and gain privileges before the legitimate administrator. Affected: Darwin Streaming ...

CVE-2003-0502

CVE-2003-0502 affects Apple QuickTime / Darwin Streaming Server up to version 4.1.3g. The vulnerability enables a remote denial-of-service (crash) when a crafted HTTP request to port 1220 contains a \..\ sequence followed by an MS-DOS device name (e.g., AUX). The condition is that the software is...

CVE-2003-0421

CVE-2003-0421 and CVE-2003-0502 affect Apple Darwin Streaming Server / QuickTime prior to the cited fixed versions by allowing remote denial of service via an MS-DOS device name (e.g., AUX) over HTTP on port 1220. Details in the sources show that exploiting names like AUX (and variants like ..AUX...

CVE-2004-1087

Technical details about CVE-2004-1087 are not publicly available in the provided connected documents. The initial note describes a UI indicator issue on Mac OS X 10.3.6, but no specifics, fixes, or affected versions are given here. Monitor for updates.

CVE-2003-1413

The CVE-2003-1413 entry concerns Apple Darwin Streaming Server 4.1.1, where parse_xml.cgi is vulnerable to a path-based check that leaks file existence information. By supplying a filename parameter containing ".." sequences, an attacker can trigger distinct error messages that allow remote deter...

CVE-2004-1085

The CVE-2004-1085 vulnerability affects Apple Mac OS X 10.3.6 HIToolBox. It allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode. The provided documents do not include any exploit details or remediation steps. No broader impact ...

CVE-2004-1086

Technical details about CVE-2004-1086 are not publicly available in the provided connected documents; no specific affected product versions beyond Mac OS X 10.3.6 are disclosed. Monitor for updates.

CVE-2003-0053

CVE-2003-0053 describes an XSS vulnerability in parse_xml.cgi used by Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1. An attacker can supply a crafted filename parameter, which is reflected in an error message, allowing arbitrary script execution in the vi...

CVE-2004-1081

The CVE-2004-1081 issue affects Apple Mac OS X AppKit in versions 10.2.8 and 10.3.6, where the secure text input field is not properly restricted. This allows local users to read keyboard input from other applications within the same window session, compromising confidentiality (described as PART...

CVE-2004-1083

Apache on Apple Mac OS X 10.2.8 and 10.3.6 is affected by a vulnerability arising from case-sensitivity handling: Apache restricts file access in a case-sensitive way while the HFS+ filesystem on Mac is case-insensitive, allowing remote attackers to read .DS_Store and files starting with ".ht" vi...

CVE-2003-0424

The CVE-2003-0424 entry affects Apple QuickTime/Darwin Streaming Server prior to 4.1.3f. The vulnerability allows an attacker to disclose script source code by appending encoded characters (%20 space or %2e dot) to an HTTP request for a script (e.g., /view_broadcast.cgi). The issue is a Script So...

CVE-2004-1088

Postfix server for Apple Mac OS X 10.3.6 vulnerable when using CRAM-MD5: remote attackers can send mail without authentication by replaying authentication information. Reported CVSSv2 base score 7.5 (HIGH) with network attack vector and low attack complexity. The provided documents do not specify...

CVE-2004-1084

The CVE-2004-1084 entry describes an Apache on Mac OS X vulnerability affecting versions 10.2.8 and 10.3.6 where remote attackers can read files and resource fork content via HTTP requests to specially named HFS+ data streams, bypassing Apache file handles. The root cause is related to how HFS+ d...

CVE-2003-0052

CVE-2003-0052 applies to Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1, where parse_xml.cgi allows remote attackers to list arbitrary directories due to unvalidated input. Public sources (ATstake advisory, vendor notices) describe it as a directory-listin...

CVE-2004-0169

CVE-2004-0169 concerns QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2. The vulnerability arises when processing RTSP DESCRIBE requests with overly long User-Agent fields, triggering an Assert in BufferIsFull and potentially crashing the server. Multiple sources corroborate that remote at...

CVE-2004-1089

CVE-2004-1089 affects Apple Mac OS X 10.3.6 Server when using Kerberos authentication with Cyrus IMAP. The vulnerability, as described in the initial document, allows local users to access mailboxes of other users, indicating an information disclosure / mailbox access issue arising from the Cyrus...

CVE-2003-0425

Apple QuickTime/Darwin Streaming Server before 4.1.3f (Win32) is vulnerable to Web Root Traversal and Arbitrary File Disclosure via HTTP requests containing three dots to break out of the web root (e.g., /.../qtusers). The issue affects Darwin Streaming Server v4.1.3e and earlier (Win32). Fixed: ...