CVE-2004-2687: distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, all...

Security readout for executives and security teams

CVE-2004-2687 affects distcc 2.x when its server port is reachable without access restrictions. In that state, a remote attacker can submit compilation work that the server runs without authorization checks, leading to arbitrary command execution. The business risk is highest for old build hosts exposed to untrusted networks. Exposure is likely limited to legacy systems running distcc 2.x, including historical XCode 1.5 environments, with the distcc server port reachable from untrusted networks. Internal build networks are the main place to check. Treat as a priority legacy exposure review. It is not broadly urgent without exposed distcc 2.x, but any reachable instance can become direct remote command execution on a build host. Mitigation focus: Restrict distcc server access to trusted build clients only.; Disable distcc on hosts where it is no longer required.; Block the distcc server port from untrusted networks..

Prepared

Jun 29, 2026, 03:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.