MOAB-15-01-2007: Multiple Mac OS X Local Privilege Escalation Vulnerabilities

Multiple binaries inside the /Applications directory tree are setuid root, but remain writable by users in the admin group (ex. first user by default in a non-server Mac OS X installation), allowing privilege escalation. A malicious user can overwrite the binaries and perform a disk permissions repair operation via the diskutil tool, effectively setting back the default ownership and permissions (root setuid).

Further information:

• MOAB-15-01-2007
• Exploit: MOAB-15-01-2007.rb

Thanks to Ian Silvester for donating to the project!

MOAB-06-01-2007: Multiple Vendor PDF Document Catalog Handling Vulnerability

The current PDF specification is affected by a design flaw: a rogue Pages entry or malicious catalog dictionary could cause a denial of service (memory corruption condition, memory leakage, etc) or potential arbitrary code execution in the reader application.

Further information:

• Multiple Vendor PDF Document Catalog Handling Vulnerability
• Proof of concept: MOAB-06-01-2007.pdf

One of those nice issues you "can't" find with so-called fuzzing, but instead reading the format specification...