Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mac OS X Sudo Password Bypass

packetstormsecurity.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Mac OS X Sudo Password Bypass

#41

Post by KMag »

rcthompson wrote: post #37

How much sense would it make to annotate a variable as being representative of a "present time" and then have the compiler insert a check that the variable must be greater than the time at which the file was compiled (plus or minus some fuzz to account for daylight savings and time zones)?

Repeat after me "timestamps should always be UTC. Time zones and DST should be left to the display layer".

In any case, as a security measure, preventing the clock from being set before the compile time is a bandaid for a bullet hole.

Re: Mac OS X Sudo Password Bypass

#42

Post by KMag »

stcredzero wrote: post #40

No security that needs time should be based on an insecure clock. Is there any kind of network "verified time" facility using PKC?

You'd need interactive signatures to prevent replays of very old timestamps, which significantly hurts scalability of the signed timestamps. However, I suppose with a weaker trust model one could have a federated signed timestamp service, where you could get timestamps over TLS/SSL.

Re: Mac OS X Sudo Password Bypass

#44

Post by benjamincburns »

audidude wrote: post #33
benjamincburns wrote: post #30

I'm very surprised that the 'sudo' timeout feature wasn't implemented against the system's RTC using something like CLOCK_MONOTONIC. Or put differently, the idea that you'd use absolute time to implement a requirement that's defined in terms of relative time seems a bit absurd. Anyone have any clues as to why this wasn't implemented that way? For reference, CLOCK_MONOTONIC is defined in time.h and is part of the POSI…

CLOCK_MONOTONIC is not available on OS X. Also, isn't CLOCK_MONOTONIC_RAW fetching the counter from rdtsc instruction on x86? (And therefore can go backwards in time if your process is migrated to another CPU). Keep in mind, also, that the CLOCK_MONOTONIC is not part of the core POSIX standard, so OS X is technically "compliant" even though they didn't implement it. Add this to a list of annoyances, such as no pthrea…

No CLOCK_MONOTONIC in OS X?

In a David Tennant voice: Wait, what?? What?!

  ~$ grep CLOCK_MONOTONIC /usr/include -rn
  ~$
Ahh, it's in the POSIX realtime extension... Dammit.

Apparently [1] one solution would be to #IFDEF DARWIN the following, as on Darwin SYSTEM_CLOCK is supposed to be a monotonic boot clock.

  #include 
  #include 
  
     ...
  
  clock_serv_t cclock;
  mach_timespec_t mts;

  host_get_clock_service(mach_host_self(), SYSTEM_CLOCK,
  &cclock);
  clock_get_time(cclock, &mts);
  mach_port_deallocate(mach_task_self(), cclock);
Not sure if processor affinity would affect that code (don't have time right now to do the in depth reading on it), but you could always set affinity to CPU0. Though then you'd have to make sure to run the sudo'd command as a child process and appropriately reset affinity to default before a call to exec...

Re: Mac OS X Sudo Password Bypass

#45

Post by gpvos »

mikeash wrote: post #18
Someone wrote: post #11

"If [...], it is possible to become the super user by running `sudo -k` and then resetting the system clock to 01-01-1970" Can users reset the Mac OS X system clock without being an admin?

You need to be an administrator, but you do not need to be root. This exploit lets you start from an administrator account for which you don't have a password (but have gained access to through other means, like exploiting an app run by an administrator user) and then leverage that into root access, something that normally requires the password for the account.

You can actually prevent the exploit from working by locking the "date and time" tab of the system preferences. The exploit will then cause the usual password popup to appear. (On 10.6 at least.)

Re: Mac OS X Sudo Password Bypass

#46

Post by bits »

npongratz wrote: post #39

sudo offers updated binaries for OS X 10.5 and up so you don't have to wait for Apple: http://www.sudo.ws/sudo/download.html#binary If you don't trust the binaries, I found it easy to update the vulnerable sudo v1.7.0 on my OS X 10.6 machine by building from source and overwriting the one supplied by Apple: 0) Backup /usr/bin/sudo (temporarily; you'll want to delete the old sudo after verifying the new one works), an…

If you use `configure --prefix=/usr/bin`, you'll end up with sudo installed in /usr/bin/bin/sudo. Instead, try

   ./configure --prefix=/usr
to use the /usr hierarchy (/usr/bin, /usr/sbin, /usr/share, etc...) instead of the /usr/local hierarchy.

Also, if you're able to run an executable in the current directory without specifying its location, as in configure instead of ./configure, then you have . (pwd) in your $PATH, which isn't recommended because a malicious executable might be in the directory you're in, and it might be named something like ls. Just listing the directory could have you owned.

Re: Mac OS X Sudo Password Bypass

#47

Post by simscitizen »

benjamincburns wrote: post #44
audidude wrote: post #33

Earlier quoted context omitted.

CLOCK_MONOTONIC is not available on OS X. Also, isn't CLOCK_MONOTONIC_RAW fetching the counter from rdtsc instruction on x86? (And therefore can go backwards in time if your process is migrated to another CPU). Keep in mind, also, that the CLOCK_MONOTONIC is not part of the core POSIX standard, so OS X is technically "compliant" even though they didn't implement it. Add this to a list of annoyances, such as no pthrea…

No CLOCK_MONOTONIC in OS X? In a David Tennant voice: Wait, what?? What?! ~$ grep CLOCK_MONOTONIC /usr/include -rn ~$ Ahh, it's in the POSIX realtime extension... Dammit. Apparently [1] one solution would be to #IFDEF DARWIN the following, as on Darwin SYSTEM_CLOCK is supposed to be a monotonic boot clock. #include #include ... clock_serv_t cclock; mach_timespec_t mts; host_get_clock_service(mach_host_self(), SYSTEM_…

On OS X, use mach_absolute_time() to get a monotonic clock. A lot of APIs in OS X use the monotonic clock, e.g. CoreAnimation wraps mach_absolute_time() as CACurrentMediaTime() and uses that to calculate animation start times and delays.

Re: Mac OS X Sudo Password Bypass

#48

Post by ams6110 »

Steuard wrote: post #6
wcchandler wrote: post #5

The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...

Not at all a safe assumption. Most importantly, it's not that uncommon for even less experienced Mac users to copy and paste Terminal commands to solve one problem or another. A lot of those "Just type this!" solutions I've seen involve sudo somewhere. But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that…

Particularly installer scripts that are run by the trendy technique of

  curl -L http://www.example.com/some/cool/thing/install.sh | bash
Particularly risky if the protocol is not https. Even worse when the right-hand command is "sudo bash"

Re: Mac OS X Sudo Password Bypass

#50

Post by valleyer »

audidude wrote: post #33
benjamincburns wrote: post #30

I'm very surprised that the 'sudo' timeout feature wasn't implemented against the system's RTC using something like CLOCK_MONOTONIC. Or put differently, the idea that you'd use absolute time to implement a requirement that's defined in terms of relative time seems a bit absurd. Anyone have any clues as to why this wasn't implemented that way? For reference, CLOCK_MONOTONIC is defined in time.h and is part of the POSI…

CLOCK_MONOTONIC is not available on OS X. Also, isn't CLOCK_MONOTONIC_RAW fetching the counter from rdtsc instruction on x86? (And therefore can go backwards in time if your process is migrated to another CPU). Keep in mind, also, that the CLOCK_MONOTONIC is not part of the core POSIX standard, so OS X is technically "compliant" even though they didn't implement it. Add this to a list of annoyances, such as no pthrea…

pthread_cond_timedwait has existed on OS X since Tiger. Look in /usr/include/pthread.h.
Post reply on HN