Mac OS X Sudo Password Bypass
packetstormsecurity.com
Mac OS X Sudo Password Bypass
1–10 of 53 posts
Re: Mac OS X Sudo Password Bypass
#2Appears to be fixed in 10.8.5, the MSF posted doesn't work under 10.8.4 for me either.
Re: Mac OS X Sudo Password Bypass
#3Well... this is dangerous...
Re: Mac OS X Sudo Password Bypass
#4doesn't work on 10.8.4 for me
Re: Mac OS X Sudo Password Bypass
#5The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
Re: Mac OS X Sudo Password Bypass
#6The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
Not at all a safe assumption. Most importantly, it's not that uncommon for even less experienced Mac users to copy and paste Terminal commands to solve one problem or another. A lot of those "Just type this!" solutions I've seen involve sudo somewhere.
But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that you run without sudo? I know that I don't.
Re: Mac OS X Sudo Password Bypass
#7The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
A few points:
- The default user created at setup of OSX is in the admin group.
- Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!)
- Do you habitually read every line of source code your computer would execute before you run that code?
Re: Mac OS X Sudo Password Bypass
#8The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
Not at all a safe assumption. Most importantly, it's not that uncommon for even less experienced Mac users to copy and paste Terminal commands to solve one problem or another. A lot of those "Just type this!" solutions I've seen involve sudo somewhere. But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that…
"A lot of those "Just type this!" solutions I've seen involve sudo somewhere."
Not sure if you're alluding to this trick: http://thejh.net/misc/website-terminal-copy-paste
This particular exploit could be rather nasty when used in conjunction with the above.
Re: Mac OS X Sudo Password Bypass
#9The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
A few points: - The default user created at setup of OSX is in the admin group. - Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!) - Do you habitually read every line of sourc…
You mean installing Homebrew itself? Because if you're running "sudo brew install foo" you're doing it wrong.
Re: Mac OS X Sudo Password Bypass
#10The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...
A few points: - The default user created at setup of OSX is in the admin group. - Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!) - Do you habitually read every line of sourc…
Homebrew fails if you attempt to run it with sudo.