|
Brought to you by:
Suppliers of:
|
|
|
| |
"Cocktail is a general purpose utility for Mac OS X. The application serves up a scrumptious mix of maintenance tools and interface tweaks, all accessible via a comprehensive graphical interface and toolset. It is a smooth and powerful utility that simplifies the use of advanced UNIX functions."
Cocktail passes administrator password in an insecure way, i.e. simply revealing it to local system users. Exploiting this vulnerability may lead to privilege escalation by a local user. |
| |
Credit:
The information has been provided by sonderling.
|
| |
Vulnerable Systems:
* Mac OS X Cocktail version 3.5.4
Immune Systems:
* Mac OS X Cocktail version 3.6
Since cocktail needs administrative privileges the user is prompted for the administrative password upon the startup of the product.
The maintenance of the product is done by command line utilities that are executed in an insecure manner:
1. Cocktail creates a new process
2. Lets /bin/sh pipe the administrative password using echo into sudo
3. Then it will execute the utility
Which will result in the following command being created:
sh -c echo 'PASSWORD' | sudo -p "" -S sudo update_prebinding -root /
Exploitation:
By knowing that Cocktail is waiting for some UNIX utility to finish its work, execute "ps ax" on the terminal and search for the password.
|
|
|
|
|
