CVE-2004-0922 - Undamped Slot

Description

AFP Server on Mac OS X 10.3.x to 10.3.5 under certain conditions does not properly set the guest group ID which causes AFP to change a write-only AFP Drop Box to be read-write when the Drop Box is on a share that is mounted by a guest which allows attackers to read the Drop Box.

Reference

http://lists.apple.com/archives/security-announce/2004/Oct/msg00000.html http://www.securityfocus.com/bid/11322