[39121] in bugtraq
Re:[ Suresec Advisories ] - Mac OS X 10.4 - launchd local root
daemon@ATHENA.MIT.EDU (Jonathan Weiss)
Fri Jun 10 13:57:51 2005
Date: Fri, 10 Jun 2005 16:30:29 +0200
From: Jonathan Weiss <jw@innerewut.de>
To: "[ Suresec Advisories ]" <advisories@suresec.org>,
BugTraq <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>,
<full-disclosure@lists.grok.org.uk>
Message-ID: <BECF70A5.2742B%jw@innerewut.de>
In-Reply-To: <1D728B0E-D8E7-42DF-A5B7-3622FB50AE50@suresec.org>
Mime-version: 1.0
Content-type: text/plain;
charset="US-ASCII"
Content-transfer-encoding: 7bit
> Securesec Security Advisory - #00003
> 09/06/05
>
> Apple Mac OS X 10.4 launchd race condition vulnerability
> Advisory: http://www.suresec.org/advisories/adv3.pdf
>
> Description:
>
> A race condition vulnerability has been found in the temporary file
> creation done by the suid launchd program on Mac OSX 10.4.
> The for advisory for this can be downloaded from the Suresec website.
>
> Risk:
>
> Successful exploitation of this vulnerability results in stolen
> ownership of any file on the system. Using this it is trivial to get
> a root shell.
>
Is this fixed by the security update issued by apple some days ago?
> Credit:
>
> The vulnerability was discovered by Neil Archibald and Ilja Van Sprundel
>
Jonathan
--
Jonathan Weiss
jw@innerewut.de
http://blog.innerewut.de
