Techsurvivors
Archives => 2003 => Topic started by: Diana on February 24, 2003, 07:35:00 PM
-
5. Apple MacOS Classic TruBlueEnvironment Environment Variable Privilege Escalation Vulnerability
BugTraq ID: 6859
Remote: No
Date Published: Feb 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6859
Summary:
Apple MacOS X includes a Classic emulator to support applications written for Classic versions of the operating system.
Apple has released a client security update which details a vulnerability in the Apple MacOS Classic environment for MacOS X, which may lead to elevation of privileges. This issue exists in TruBlueEnvironment, which is included in the emulator.
It has been reported that an environment variable used by TruBlueEnvironment may be changed to cause arbitrary local files to be overwritten or created. The environment variable is used to define a location to output debugging information to a file.
TruBlueEnvironment will create or overwrite the debugging file with world-writeable privileges, depending on the umask of the process creating the file. The file will not be executable when it is created. However, a facility such as cron may potentially run the file through a shell interpreter. This may cause the file to run with elevated privileges, resulting in privilege escalation. A denial of service is also possible if critical system files are corrupted by the attacker.
6. Apple File Protocol iDrive Administrator Login Weakness
BugTraq ID: 6860
Remote: Yes
Date Published: Feb 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6860
Summary:
Apple File Protocol (AFP) is used with Apple's iDisk' feature to allow systems to store files on Apple's site.
The AFP allows a system administrator to log onto a system as a normal user using administration credentials. This is the default behaviour. When authenticating, it is possible for an attacker to obtain the administrator credentials by intercepting data.
Further details about this issue are not known at this time. This BID will be updated as further information becomes available.
-
Apparently 10.2.4 is not vulnerable...
-
We have a long way to go to catch up.
Introducing the Lovgate.C Trojan
http://theregister.co.uk/content/56/29448.html