full-disclosure - Vuln. MacOSX/Safari: Remote help-call, execute scripts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <69EB3840-A72D-11D8-8380-000A95C585F0@troelsbay.dk>
From: troelsbay at troelsbay.dk (Troels Bay)
Subject: Vuln. MacOSX/Safari: Remote help-call, execute scripts

I usually complain a lot about the Windows-security settings, and  
consider *NIX systems to be of an entirely different level. But this  
time I found my own arguments off short.

I'm an OS X user, and I would like to submit to you the latest exploit  
for this system. As I hope a fix will be running in soon... Perhaps the  
more people who know, the sooner a fix will be up (I might be  
considered naive here...)

The Setting:
The Help-application of OS X uses ordinary html-pages to display  
troubleshooting/etc, and parses a special command when displaying  
help-links that, for instance, open System Preferences, Finder etc.  
This command uses a built-in protocol called "help:" and can easily be  
exploited since Safari (the default browser, and possible every other  
browser on the system) can use the same protocol - probably due to the  
Help-application's dependency on the Safari html-engine.

This means that a simple homepage meta redirect call can use it,  
without the user having to do anything but surf to the site, or it can  
be a simple href link on the site. This is an example of how it works:

help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt

Use:
This, placed as a link on a homepage, will trick Safari to 1) open the  
Help-application 2) open the "Current Date & Time" script. Though the  
Date & Time script is pretty harmless, consider that one can (through  
another link or meta redirect call) use the disk:// protocol to mount a  
script on /Volumes/danger.scpt and then let the link from above execute  
it, by altering the path.

Vulnerable Systems:
Mac OS X 10.3
(probably will work with 10.2 as well, but I cannot test that, someone  
please confirm?)

Risk:
This can potentially wipe the entire hard-disk (or large parts of it),  
if a hacker runs a script with "rm -rf /" included.

Solution:
Alter the "help:" protocol to use another application than "Help" (for  
quick editing use "MisFox" or "Default Apps"-3rdparty prefpane)

The funny thing is that this newly assigned application (in my case a  
Chess program) will open whenever a hacker tries to use the  
vulnerability, or whenever you rightfully try to use the  
Helper-application's special links.

Credits:
I can only be seen as the messenger here, the real credits are to be  
found on the forums of macnn:  
http://forums.macnn.com/showthread.php? 
s=&threadid=213043&perpage=50&pagenumber=1

Off topic:
I'm still waiting for that psexec tool look-a-like for *NIX, I hope  
some people are working on it, perhaps samba could get a grip and  
implement "NET SERVICE" anytime soon.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/enriched
Size: 2665 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040516/f09ef631/attachment.bin