ID

VAR-200701-0400

CVE

CVE-2007-0467

TITLE

Apple CrashDump privilege escalation

DESCRIPTION

crashdump in Apple Mac OS X 10.4.8 allows local users in the admin group to modify arbitrary files or gain privileges via a symlink attack on application logs in /Library/Logs/CrashReporter/. CrashReporter contains a privilege escalation vulnerability that may allow authenticated users to run commands as root. In order to exploit this vulnerability, — Must belong to the management group of Cull. Mac OS X is prone to a denial-of-service vulnerability. Local attackers may use this vulnerability to elevate their privileges. If an anomaly is detected, a crashdump is launched to investigate the cause of the crash and report it to the user. When reporting an exception, crashdump will first try to write the report to the user's home directory (/Users/[user]/Library/Logs/CrashReporter/), and if the home directory is unavailable due to permissions, etc., it will try to use the system A scoped log directory, such as /Library/Logs/CrashReporter/. But crashdump follows symlinks and users in the administrators group have write access to the directory. Since crashreporterd runs with root privileges, an attacker can embed a symbolic link in the /Library/Logs/CrashReporter/ directory to modify arbitrary files. ---------------------------------------------------------------------- To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German. The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios. This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links Read the full description: http://corporate.secunia.com/products/48/?r=l Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l ---------------------------------------------------------------------- TITLE: Mac OS X Mach-O Universal Binary Memory Corruption SECUNIA ADVISORY ID: SA23088 VERIFY ADVISORY: http://secunia.com/advisories/23088/ CRITICAL: Less critical IMPACT: DoS, System access WHERE: Local system OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/ DESCRIPTION: LMH has reported a vulnerability in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or potentially gain escalated privileges. The vulnerability is caused due to an error in the fatfile_getarch2() function. This can be exploited to cause an integer overflow and may potentially allow execution of arbitrary code with kernel privileges via a specially crafted Mach-O Universal binary. Other versions may also be affected. SOLUTION: Grant only trusted users access to affected systems. PROVIDED AND/OR DISCOVERED BY: LMH ORIGINAL ADVISORY: http://projects.info-pull.com/mokb/MOKB-26-11-2006.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

unknown

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Kevin Finisterre dotslash@snosoft.com LMH lmh@info-pull.com

SOURCES

LAST UPDATE DATE

2024-09-19T22:09:18.476000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE