MOAB-28-01-2007: Apple crashdump Privilege Escalation Vulnerability

crashdump follows symlinks within the /Library/Logs/CrashReporter/ directory, allowing admin-group users to execute arbitrary code and overwrite files with elevated privileges. In couple with a specially crafted Mach-O binary, this can be used to write a malicious crontab entry, which will run with root privileges.

• Apple crashdump Privilege Escalation Vulnerability
• Exploit: MOAB-28-01-2007.rb and vuln
  

MOAB-22-01-2007: Apple UserNotificationCenter Privilege Escalation Vulnerability

UserNotificationCenter retains wheel privileges on execution time, and still has a UID associated with the current user. Because of this, it> will attempt to run any InputManager provided by the user. Code within the input manager will run under wheel privileges. In combination with diskutil and a wheel-writable setuid binary, this allows unprivileged users to gain root privileges.

Further information:

• Apple UserNotificationCenter Privilege Escalation Vulnerability
• Exploit: MOAB-22-01-2007.rb

Update: updated exploit (now fat binaries are used, thus exploit should work on a system without XCode and related developer tools; source code is provided to avoid the usual FUD about alleged 'root kits' and non-sense), release information, etc. KF worked hard on getting stuff up due to connectivity issues. He deserves a thumbs-up from everyone.

MOAB-21-01-2007: System Preferences writeconfig Local Privilege Escalation Vulnerability

The preference panes setuid helper, writeconfig, makes use of a shell script which lacks of PATH sanitization, allowing users to execute arbitrary binaries under root privileges.

Further information:

• System Preferences writeconfig Local Privilege Escalation Vulnerability
• Exploit: MOAB-21-01-2007.rb

This week will be a really interesting one.

"Also, I’m pretty sure the SoD realized that writing to an SUID executable clears the SUID bit." -- Thomas Ptacek, Matasano.

Actually, the problem isn't 'writing to setuid binaries' but the fact that diskutil "repairs permissions", thus after replacing directories, binaries and any other file, the original modes are set back. In other words: replace setuid binary with one of your choice (given that a BOM/Bill of Materials file acknowledges it's existence and properties), run diskutil repair permissions, profit. It remains unknown if Thomas just didn't understand the point or simply continues his usual blog wagon. Probably both.

MOAB-18-01-2007: Rumpus Multiple Vulnerabilities

rumpusd is vulnerable to different remotely exploitable heap-based buffer overflows, denial of service conditions and local privilege escalation issues. Due to the fact that Rumpus works under root privileges, successful exploitation by unprivileged users would allow a full compromise of the system.

Most of these issues are related to both FTP and HTTP request parsing, as well as insecure use of the system() function and incorrect permissions and/or handling of setuid binaries.

Further information:

• MOAB-18-01-2007: Rumpus Multiple Vulnerabilities
• Proof of concept: MOAB-18-01-2007.rb

MOAB-17-01-2007: Apple SLP Daemon Service Registration Buffer Overflow Vulnerability

slpd is vulnerable to a buffer overflow condition when processing the attr-list field of a registration request, leading to an exploitable denial of service condition and potential arbitrary execution. It would allow unprivileged local (and possibly remote) users to execute arbitrary code under root privileges.

For further information:

• Apple SLP Daemon Service Registration Buffer Overflow Vulnerability
• Proof of concept: MOAB-17-01-2007.rb

This issue was reported to Apple on 8/2/06 5:31 PM.

MOAB-15-01-2007: Multiple Mac OS X Local Privilege Escalation Vulnerabilities

Multiple binaries inside the /Applications directory tree are setuid root, but remain writable by users in the admin group (ex. first user by default in a non-server Mac OS X installation), allowing privilege escalation. A malicious user can overwrite the binaries and perform a disk permissions repair operation via the diskutil tool, effectively setting back the default ownership and permissions (root setuid).

Further information:

• MOAB-15-01-2007
• Exploit: MOAB-15-01-2007.rb

Thanks to Ian Silvester for donating to the project!

MOAB-14-01-2007: AppleTalk ATPsndrsp() Heap Buffer Overflow Vulnerability

The _ATPsndrsp function is vulnerable to a heap-based buffer overflow condition, due to insufficient checking of user input. This leads to a denial of service condition and potential arbitrary code execution by unprivileged users.

For further information:

• AppleTalk ATPsndrsp() Heap Buffer Overflow Vulnerability
• Proof of concept: MOAB-14-01-2007.c

More to come. In case you want to support the project, consider a donation for the 'get a mini' fund-raising :-). As soon as it gets worked out, advertisement should probably vanish. Hopefully.

MOAB-08-01-2007: Application Enhancer (APE) Local Privilege Escalation

Application Enhancer (APE) is affected by different issues, one of them is a local privilege escalation vulnerability which allows local users to gain root privileges in the system by either patching the ApplicationEnhancer binary or replacing it. This binary is executed with root privileges and drops them (via setuid to current user id), but the file is actually writable, as well as the whole tree under /Library/Frameworks, allowing the mentioned condition to be abused for privilege escalation.

Further information:

• Application Enhancer (APE) Local Privilege Escalation
• Mandatory exploit: exploit-of-the-apes.rb

Update: We just received an e-mail suggesting that Unsanity might have fixed this issue silently (replacing their available DMG of the 2.0.2 release with a new one). Until we verify that, we can't assume they really did it (which would be the most probable reaction at their side, though). A short (yet detailed) explanation is available at the MoAB Fixes Google Group.

Update: Not fixed, yet:

MD5 (../ape/ape-202.dmg) = b9388ac7a64d03a07a565906b6ef4510
MD5 (../ape/silent/ape-202-orig_after.dmg) = b9388ac7a64d03a07a565906b6ef4510


MOAB-05-01-2007: Apple DiskManagement BOM Local Privilege Escalation Vulnerability

A vulnerability in the handling of BOM files allows to set rogue permissions on the filesystem via the 'diskutil' tool. This can be used to execute arbitrary code and escalate privileges. A malicious user could create a BOM declaring new permissions for specific filesystem locations (ex. binaries, cron and log directories, etc). Once 'diskutil' runs a permission repair operation the rogue permissions would be set, allowing to plant a backdoor, overwrite resources or simply gain root privileges.

For further information:

• Apple DiskManagement BOM Local Privilege Escalation Vulnerability
• Exploits: MOAB-05-01-2007.rb and MOAB-05-01-2007_cron.rb (uses crontab, recommended).