CVE-2003-0466: Apple Mac OS X

Critical severity, CVSS 9.8. EPSS: 78.1% chance of exploitation in the next 30 days.

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

Affected products

• Apple Mac OS X: version 10.2.6 only
• Apple Mac OS X Server: version 10.2.6 only
• Freebsd Freebsd: from 4.0, up to and including 5.0
• Netbsd Netbsd: from 1.5, up to and including 1.6.1
• OpenBSD OpenBSD: from 2.0, up to and including 3.3
• Red Hat Wu Ftpd: version 2.6.1-16 only
• Sun Solaris: version 9.0 only
• Wuftpd Wu-Ftpd: from 2.5.0, up to and including 2.6.2

Published 2003-08-27. Last modified 2026-06-16.