Re: Buffer overflow/privilege escalation in MacOS X - hfs.util also Dec 19 2003 05:17AM
KF (dotslash snosoft com)
The funny thing is that I have reported this to apple more than once if
I remember correctly... first in 10.1 and recently in 10.3, I have yet
to hear back on the issue. As a side note apple has a no talky / no
verify policy until the bug is fixed... they just keep you pretty much
100% in the dark. Dave G finally talked some sense into me and I stopped
trying to exploit the hole. I have spent many hours banging my head
trying to figure out why things will not work out. I had been holding
out for a response from apple but since this is now public info I'll
probably jot down some public notes on what a pain it is. If any one is
interested the code causing this issue it is located below.

*In earlier versions of OSX there is also hfs.util and it contains the
same issue. hfs.util is no longer setuid in OSX 10.3*


char myRawDeviceName[256];
char myDeviceName[256];
/* Build our device name (full path), should end up with something like: */
/* /dev/disk1s2 */
strcpy( &myDeviceName[0], DEVICE_PREFIX );
strcat( &myDeviceName[0], argv[2] );
strcpy( &myRawDeviceName[0], RAW_DEVICE_PREFIX );
strcat( &myRawDeviceName[0], argv[2] );
/* call the appropriate routine to handle the given action argument
after becoming root */
myActionPtr = &argv[1][1];
myError = seteuid( 0 );
switch( *myActionPtr ) {
exit (myError);

------------------- and the vulnerability in hfs.util that was not
reported --------------------

char rawDeviceName[MAXPATHLEN];
char blockDeviceName[MAXPATHLEN];
/* -- Build our device name (full path), should end up with something
like: -- "/dev/disk0s2" */
sprintf(rawDeviceName, "/dev/r%s", argv[2]);
sprintf(blockDeviceName, "/dev/%s", argv[2]);

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus