|
Brought to you by:
Suppliers of:
|
|
|
| |
TruBlueEnvironment is part of the MacOS Classic Emulator. It is setuid root and installed by default.
There is a buffer overflow vulnerability in the application, that allows a user with interactive access to escalate privileges to root. |
| |
Credit:
The information has been provided by at stake.
The original article can be found at: http://www.atstake.com/research/advisories/2004/a012704-1.txt.
|
| |
Vulnerable Systems:
* Mac OS X versions 10.2.x, 10.3.x
CVE Information:
CAN-2004-0089 TruBlueEnvironment Buffer Overflow
TruBlueEnvironment takes the value of an environment variable and copies it into a buffer without performing any bounds checking. Since this buffer is stored on the stack, it is possible to overwrite the return stack frame and execute arbitrary code as root.
Workaround
Restrict access to the TruBlueEnvironment(*) executable, or remove it entirely if it is not being used. One approach to restricting access would be to remove global execute permissions from the TruBlueEnvironment executable, and only allow a specific group to execute the application.
The following commands will restrict access to the 'admin' group:
sudo chown .admin
/System/Library/CoreServices/Classic\
Startup.app/Contents/Resources/TruBlueEnvironment
sudo chmod 4750
/System/Library/CoreServices/Classic\
Startup.app/Contents/Resources/TruBlueEnvironment
(*) Located in
/System/Library/CoreServices/Classic\
Startup.app/Contents/Resources/TruBlueEnvironment
Vendor Status:
This is fixed in Security Update 2004-01-26.
|
|
|
|
|
