DMA[2005-0818a] - 'Apple OSX dsidentity privilege abuse'
DMA[2005-0818a] - 'Apple OSX dsidentity privilege abuse'
Author: Kevin Finisterre
Vendor: http://www.apple.com/bluetooth/
Product: 'Mac OSX 10.4'
References:
http://www.digitalmunition.com/DMA[2005-0818a].txt
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2508
http://www.suresec.org/advisories/adv5.pdf
Description:
After roughly one hour of beating on the freshly released OSX 10.4 I found that
/usr/sbin/dsidentity
allows any user on the system to add accounts to Directory Services. Passwords
can easily be set at
the time of account creation, and the newly created account can be used to
login to the OSX gui. Due
to the lack of shell the account is limited in nature, however once you have
logged into the gui
accessing a shell is trivial.
To add an account simply use the following command line and then you can now
login as RickJames with the
password isapimp.
CrunkJuice:~ kevinfinisterre$ /usr/sbin/dsidentity -a RickJames -s isapimp -v
After logging in as RickJames open Safari and type file:///bin in the address
bar. Double click on bash.
Ignore the warning about not being authorized, and then click cancel when asked
to close the application.
Voila Now you have a working bash shell as RickJames.
To remove an account from Directory Services use the following.
CrunkJuice:~ kevinfinisterre$ /usr/sbin/dsidentity -r CharlieMurphy -v
If you rally want to piss off someone's Directory Services try the following.
CrunkJuice:~ kevinfinisterre$ /usr/sbin/dsidentity -a `perl -e 'print "A" x
29000'`
(lather, rinse, repeat)
Work Around:
Install 2005-007 update or just rm -rf /usr/sbin/dsidentity
http://www.apple.com/support/downloads/
Sidenote:
Neil Archibald of Suresec LTD also reported this issue to apple at the same
time I did.
http://www.suresec.org/advisories/adv5.pdf outlines extra detail about this
issue with
regard to the use of getenv() calls.
Timeline associated with this bug:
05/25/2005 reported to apple.
05/26/2005 followup to auto ticketing system #9116351
08/03/2005 AppleSeeds!
08/17/2005 Security Update 2005-007 v1.1