bugtraq - Re: Local root exploit on Mac OS X with Adobe Version Cue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <041207190514.AA07763.SM@caleb.ins.cwru.edu>
Date: Tue, 7 Dec 2004 14:05:14 -0500
From: Chet Ramey <chet@...eb.ins.cwru.edu>
To: fintler@...il.com
Cc: bugtraq@...urityfocus.com, chet@...cwru.edu, llattanzi@...le.com
Subject: Re: Local root exploit on Mac OS X with Adobe Version Cue


> Local root exploit on Mac OS X 10.3.6 with Adobe products installed
> Found by Jonathan Bringhurst <fintler@...il.com.NOSPAM>
> 
> Summary:
> 
> It's possible to create a suid root shell with a non-privileged user
> on a Mac OS X 10.3.6 system with Adobe Version Cue installed. Adobe
> Version Cue is installed by default with virtually every recent Adobe
> product. This most likely affects many versions of Mac OS X and Adobe
> Version Cue.
> 
> Details:
> 
> Scripts to start and stop Adobe Version Cue are suid root and do not
> make any checks to see if they are running from the correct path. By
> setting the current path to a controlled directory and creating
> scripts with specific names, a user can have a custom script run euid
> root.

This is the result of an Apple-introduced problem in bash-2.05b.  Bash,
as distributed, gives up setuid privileges when invoked without the -p
option, if the kernel allows setuid scripts to run.  Apple changed bash
to keep setuid if bash is invoked as `sh'.

You can solve this particular problem by removing the setuid bit from
the scripts and tightening up path checking, but it's going to be a
potential problem until Apple reconsiders their permitting setuid scripts.

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
( ``Discere est Dolere'' -- chet )
						Live...Laugh...Love
Chet Ramey, ITS, CWRU    chet@...cwru.edu    http://tiswww.tis.cwru.edu/~chet/