CVE-2004-2687 Missing authorization in n/a

Critical 9.3 Published 23 Sep 2007 Updated 16 Sep 2024

Remote attackers can execute arbitrary commands on distcc servers if access restrictions are not configured, leading to full system compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2004-2687?

CVE-2004-2687 is a critical missing authorization vulnerability in Apple Xcode, published on 23 Sep 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

Weakness: CWE-16

Which versions are affected by CVE-2004-2687?

It affects 2 products.

Products include Apple Xcode, Samba Samba.

How do I fix CVE-2004-2687?

Change a configuration setting.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2004-2687 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2687 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 7 proofs of concept on GitHub.

All Apple Xcode vulnerabilities

Sources

Also known as DEBIAN-CVE-2004-2687, GHSA-88vv-hvrc-733q.