bugtraq - Re:[ Suresec Advisories ] - Mac OS X 10.4 - launchd local root vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 10 Jun 2005 16:30:29 +0200
From: Jonathan Weiss <jw@...erewut.de>
To: "[ Suresec Advisories ]" <advisories@...esec.org>,
	BugTraq <bugtraq@...urityfocus.com>, <vulnwatch@...nwatch.org>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re:[ Suresec Advisories ] - Mac OS X 10.4 -
 launchd local root vulnerability


> Securesec Security Advisory  - #00003
> 09/06/05
> 
> Apple Mac OS X 10.4 launchd race condition vulnerability
> Advisory: http://www.suresec.org/advisories/adv3.pdf
> 
> Description:
> 
> A race condition vulnerability has been found in the temporary file
> creation done by the suid launchd  program on Mac OSX 10.4.
> The for advisory for this can be downloaded from the Suresec website.
> 
> Risk:
> 
> Successful exploitation of this vulnerability results in stolen
> ownership of any file on the system. Using this it is trivial to get
> a root shell.
> 


Is this fixed by the security update issued by apple some days ago?

> Credit:
> 
> The vulnerability was discovered by Neil Archibald and Ilja Van Sprundel
> 
Jonathan

--

Jonathan Weiss
jw@...erewut.de
http://blog.innerewut.de


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/