|
|
|
|
| |
MacOS X uses Mach exception ports to support the CrashReporter "Application Quit Unexpectedly" dialog, Problem Report dialog, process debugging, and crash dumps logs.
On vulnerable operating systems, attackers can exploit the inheritance of Mach exception ports to inject code into SUID processes, allowing non privileged users to assume root privileges. |
| |
Credit:
The information has been provided by Matasano Advisories.
The original article can be found at: http://www.matasano.com/log/530/matasano-advisory-macos-x-mach-exception-server-privilege-escalation/
|
| |
Vulnerable Systems:
* MacOS X version 10.4
* MacOS X version 10.3
* OpenStep version 4.2
Immune Systems:
* MacOS X version 10.4.8
A number of Mach-based Unix operating systems (including MacOS X and OpenStep) allow SUID executables to inherit the parent processes' exception ports. When an exception notification is received, the parent calls the kernel exception server exc_server() to process the exception and call any of a set of defined callback functions. The catch_exception_raise() callback is given Mach port send rights to the Mach thread that generated the exception and the task containing the thread. These rights allow the parent to modify the thread's context and the task's address space. A parent process may exploit this by allocating memory in the child task's address space, copying in executable code, and causing a thread in the task to execute the injected code.
Exploiting this vulnerability requires a SUID root executable that can forced to generate an exception. A number of common setuid root binaries like /usr/bin/at or /usr/bin/rlogin crash when executed with a NULL argv pointer, and this suffices to enable exploitation of this vulnerability.
Impact:
Unprivileged attackers with local access can obtain root credentials.
Vendor Response:
Apple has resolved this vulnerability as of MacOS X 10.4.8.
|
|
|
|
|
|
|
|
|
|
