search

ioasis / google-security-research

Automatically exported from code.google.com/p/google-security-research
2 stars 0 forks source link

OS X Install.framework suid root runner binary priv-esc due to not accounting for implicitly parallel nature of Distributed Objects #478

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
The Install.framework runner suid root binary does not correctly account for 
the fact that Distributed Objects
  can be connected to by multiple clients at the same time.

  By connecting two proxy objects to an IFInstallRunner and calling [IFInstallRunner makeReceiptDirAt:asRoot:]
  in the first and passing a custom object as the directory name we can get a callback to our code just after the
  makeReceiptDirAt code has called seteuid(0);setguid(0) to regain privs. Since BSD priviledges are per-process
  this means that our other proxy object will now have euid 0 without having to provide an authorization reference.

  In this second proxy we can then just call runTaskSecurely and get a root shell before returning from the first proxy's callback function
  which will then drop privs.

  build using the provided makefile and run passing the full path to the localhost shell

Original issue reported on code.google.com by ianb...@google.com on 7 Jul 2015 at 7:33

Attachments:

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 7 Jul 2015 at 7:35

GoogleCodeExporter commented 9 years ago 
(typo: the code calls seteuid(0);setegid(0); to regain the temporarily dropped 
privs)

Original comment by ianb...@google.com on 7 Jul 2015 at 7:37

GoogleCodeExporter commented 9 years ago 
Apple advisory: https://support.apple.com/en-us/HT205031

Original comment by ianb...@google.com on 13 Aug 2015 at 10:34

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 13 Aug 2015 at 10:34

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 10 Sep 2015 at 7:05