Mac OS X TruBlueEnvironment Buffer Overflow Lets Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1009252
|
|
CVE Reference: CAN-2004-0089
(Links to External Site)
|
Date: Feb 28 2004
|
Impact: Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: @Stake - L0pht
|
Version(s): Mac OS X 10.2.8, 10.3.2
|
Description: A buffer overflow was reported in the Mac OS X TruBlueEnvironment (Classic Emulator). A local user can gain root privileges on the target system.
In January 2004, @stake reported that a local user can set a specially crafted environment variable to trigger a stack overflow in
TruBlueEnvironment and execute arbitrary code. The TruBlueEnvironment is reportedly configured with set user id (setuid) root user
privileges, so the code will run with root privileges.
The original advisory is available at:
http://www.atstake.com/research/advisories/2004/a012704-1.txt
|
Impact: A local user can execute arbitrary code with root privileges.
|
Solution: The vendor has released a fix as part of Security Update 2004-01-26, available at:
* Software Update pane in System Preferences
* Apple's Software Downloads web site:
Mac OS X 10.3.2 Client
======================
http://www.info.apple.com/kbnum/n120301
The download file is named: "SecurityUpd2004-01-26Pan.dmg"
Its SHA-1 digest is: 8977b3420a6343d53b79f23c409a601d269d87a4
Mac OS X 10.3.2 Server
======================
http://www.info.apple.com/kbnum/n120300
The download file is named:
"SecUpdSrvr2004-01-26Pan.dmg"
Its SHA-1 digest is: 15bfa92c439c6fee1e690703359778cefabf58d7
Mac OS X 10.2.8 Client
======================
http://www.info.apple.com/kbnum/n120302
The download file is named: "SecurityUpd2004-01-26Jag.dmg"
Its SHA-1 digest is: 365401ca71387a45a34ecab5ec7278b62e3089b3
Mac OS X 10.2.8 Server
======================
http://www.info.apple.com/kbnum/n120304
The download file is named: "SecUpdSrvr2004-01-26Jag.dmg"
Its SHA-1 digest
is: 605578cbf0d6005ee5f6b474026b908e47175268
|
Vendor URL: docs.info.apple.com/article.html?artnum=61798 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (Mac OS X)
|
Reported By: "@stake Advisories" <advisories@atstake.com>
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
