Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
BID:16904
Info
Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
| Bugtraq ID: | 16904 |
| Class: | Design Error |
| CVE: |
CVE-2005-3701 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 29 2005 12:00AM |
| Updated: | May 06 2008 03:06AM |
| Credit: | Discovered by an unknown researcher. |
| Vulnerable: |
Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
The 'passwordserver' tool is prone to a local privilege-escalation vulnerability.
This issue can allow local attackers on Open Directory master servers to gain elevated privileges.
NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability.
The 'passwordserver' tool is prone to a local privilege-escalation vulnerability.
This issue can allow local attackers on Open Directory master servers to gain elevated privileges.
NOTE: This issue was previously discussed in BID 15647 (Apple Mac OS X Security Update 2005-009 Multiple Vulnerabilities), but has been assigned its own record to better document the vulnerability.
Exploit / POC
Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
Solution:
Apple has released advisory APPLE-SA-2005-11-29, which includes fixes to address this issue. Please see the referenced advisory for more information.
Apple Mac OS X Server 10.3
Apple Mac OS X Server 10.3.1
Apple Mac OS X Server 10.3.2
Apple Mac OS X Server 10.3.3
Apple Mac OS X Server 10.3.4
Apple Mac OS X Server 10.3.5
Apple Mac OS X Server 10.3.6
Apple Mac OS X Server 10.3.7
Apple Mac OS X Server 10.3.8
Apple Mac OS X Server 10.3.9
Apple Mac OS X Server 10.4
Apple Mac OS X Server 10.4.1
Apple Mac OS X Server 10.4.2
Apple Mac OS X Server 10.4.3
Solution:
Apple has released advisory APPLE-SA-2005-11-29, which includes fixes to address this issue. Please see the referenced advisory for more information.
Apple Mac OS X Server 10.3
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.1
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.2
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.3
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.4
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.5
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.6
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.7
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.8
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.3.9
-
Apple SecUpdSrvr2005-009Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/
Apple Mac OS X Server 10.4
-
Apple SecUpdSrvr2005-009Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg
Apple Mac OS X Server 10.4.1
-
Apple SecUpdSrvr2005-009Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg
Apple Mac OS X Server 10.4.2
-
Apple SecUpdSrvr2005-009Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg
Apple Mac OS X Server 10.4.3
-
Apple SecUpdSrvr2005-009Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg
References
Apple Mac OS X Passwordserver Local Privilege Escalation Vulnerability
References:
References:
- Vendor Home Page (Apple)