Serious security risks have been identified in Mac OS X 10.2.8 and below.

Digital security consultant, @stake, has published three security advisories outlining the issues with pre-Panther versions of the OS.

One vulnerability means that an attacker can cause Mac OS X to crash by specifying a long command line argument, and possibly execute commands as root. More information is available here.

The security advisory explains that: "While this primarily affects local users, there may be conditions where this situation is remotely exploitable if a program which receives network input spawns another process with user input."

Apple says that this vulnerability is fixed in OS X 10.3 Panther and suggests upgrading to that version.


The second vulnerability is due to many applications being installed onto Mac OS X systems with insecure file permissions. The result is that many of the files and directories that compose various applications are globally writable. More information is available here.

@stake explain that this: "Allows attackers with filesystem access to an OS X machine to replace binaries and obtain additional privileges from unsuspecting users, who may run the replaced version of the binary."

Again, Apple recommends that users upgrade to Panther, where the Finder will preserve the permissions on copied folders.

Core files

The third security vulnerability is that when a system is running with core files enabled, attackers with interactive shell access can overwrite arbitrary files, and read core files created by root-owned processes. More information is available here.

@stake says that this may result in: "Sensitive information like authentication credentials being compromised."

This is also fixed in Mac OS X 10.3 – Apple says the core files setting is off by default on all shipping versions of Mac OS X.

@Stake's chief technology officer Daniel Geer, was one of the authors of a report that warned that Microsoft's dominance of the global operating-systems market. He was fired by the company the day after the report was published.