severe security issue with Mac OS X 10.2

[davidbrit2]

Since the program would write its preference file as root, you could make com.apple.NetInfoManager.plist a symlink to anything on the disk. When NetInfo Manager goes to write its preferences, they'll get tossed over top of whatever you want. I haven't thought of any way to write arbitrary data, but this could at least be used to destroy the system.

You could probably make the program safer by removing the 'other' execute permission (chmod o-x) so that only root or Administrators can run it.

[Krevinek]

I personally would see how it runs (and if it works) without the setuid bit. I have doubts that it truly needs it myself.

[wyvern]

This email was posted to Bugtraq. It is not the old netinfo-terminal root exploit.

It does however require the insane step of making a custom printer driver (!) that then loads the terminal as root. Pretty damn unlikely.

I'm sure apple will fix it but it is NOT a severe bug. It is a nearly impossible to exploit bug.

[Krevinek]

Okay, so lemme get this straight... the user has to write a custom printer driver, GET THAT INSTALLED (How? Social Engineering is required, or having an Admin password, which makes the whole exploit moot), then print something from an app such as NetInfo being run as root...

Until I see a method of getting a custom printer driver installed WITHOUT at least admin privs, or an admin password, this exploit cannot be taken advantage of to get root access in the terminal. If they had either, they already CAN get root access in the terminal with that admin password.

Yes, it is bad that this app is running as root. I just don't see how it could be used for anything but file-destroying purposes.

[Gwailo]

Originally posted by Krevinek
Yes, it is bad that this app is running as root. I just don't see how it could be used for anything but file-destroying purposes.

Krevinek, while I agree with the mechanical analysis completely, I do not agree with your liability assessment. Data descruction is pretty darn bad. Like, oh, printing to a PDF called "/bin/tcsh"

And it's true you need physical access to the computer, in which case one can just boot to a CD and mess about. But then again I don't like to leave loose ends lying about, no matter how small.

[Krevinek]

True... I am just saying this isn't quite as bad as people think it could be

After all, don't I need physical access or VNC to control NetInfo to do the deed? Apple will take their time on this one... maybe a Sept Security Update will address it.

[Gwailo]

Oh yeah, I'm not bugging out; just giving my $0.02, and I agree that Apple will pro'lly do something about it in the near future.

[rharder]

Incidentally Disk Utility.app is also setuid 0.

-Rob