http://hackaday.com Fresh hacks every day Fri, 10 Feb 2012 11:18:55 +0000 en hourly 1 http://wordpress.com/ http://1.gravatar.com/blavatar/5560f98f805877b0e332f191cb9e0af3?s=96&d=http%3A%2F%2Fs2.wp.com%2Fi%2Fbuttonw-com.png http://hackaday.com http://hackaday.com/2008/07/05/ardagentapp-still-vulnerable/ http://hackaday.com/2008/07/05/ardagentapp-still-vulnerable/#comments Sun, 06 Jul 2008 04:30:00 +0000 Eliot http://hackaday.iheartcashews.com:8181/2008/07/05/ardagentapp-still-vulnerable/ ]]>
When Apple pushed their most recent security update, the first thing we checked was whether the ARDAgent issue was fixed. It’s not. This vulnerability lets anyone execute code as a privileged user and versions of this attack have already been found in the wild. While several Ruby, SMB, and WebKit issues were addressed it, ARDAgent is still unpatched. [Dino Dai Zovi] has published the method by which ARDAgent actually becomes vulnerable: when it starts, it installs its own Apple Event handlers and calls AESetInteractionAllowed() with kAEInteractWithSelf. This should restrict it only to its own events, but for some reason that’s not the resulting behavior. He also pointed out that SecurityAgent has displayed similar weirdness; it is vulnerable to Apple Events even though it doesn’t calls an Apple Events function. We can see how this unexpected behavior could make patch development take much longer and may end up uncovering an even bigger problem. Check out [Dino]‘s post for more information.

]]> http://hackaday.com/2008/07/05/ardagentapp-still-vulnerable/feed/ 1 RobotSkirts http://hackaday.com/2008/06/19/neutering-the-apple-remote-desktop-exploit/ http://hackaday.com/2008/06/19/neutering-the-apple-remote-desktop-exploit/#comments Thu, 19 Jun 2008 23:45:00 +0000 Eliot http://hackaday.iheartcashews.com:8181/2008/06/19/neutering-the-apple-remote-desktop-exploit/ ]]>
Yesterday, Slashdot reported a privilege escalation vulnerability in OSX. Using AppleScript you can tell the ARDAgent to execute arbitrary shell script. Since, ARDAgent is running as root, all child processes inherit root privleges. Intego points out that if the user has activated Apple Remote Desktop sharing the ARDAgent can’t be exploited in this fashion. So, the short term solution is to turn on ARD, which you can do without giving any accounts access privileges. TUAW has an illustrated guide to doing this in 10.4 and 10.5.

]]> http://hackaday.com/2008/06/19/neutering-the-apple-remote-desktop-exploit/feed/ 5 RobotSkirts