Apple Xcode OpenBase Multiple Privilege Escalation Vulnerabilities

Bugtraq ID:	20562
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-5328 CVE-2006-5327
Remote:	No
Local:	Yes
Published:	Oct 16 2006 12:00AM
Updated:	Oct 31 2007 07:36PM
Credit:	Kevin Finisterre is credited with discovering these issues.
Vulnerable:	Openbase International Ltd. OpenBase 10.0 _MacOSX Openbase International Ltd. OpenBase 9.1.5 _MacOSX Openbase International Ltd. OpenBase 8.0.4 _MacOSX Openbase International Ltd. OpenBase 7.0.15 _MacOSX Apple Xcode 2.2 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.5
Not Vulnerable:	Apple Xcode 2.3

Apple Xcode OpenBase Multiple Privilege Escalation Vulnerabilities

The OpenBase application shipped with Apple Xcode is prone to multiple privilege-escalation issues because the application fails to handle exceptional conditions when executing setuid programs.

A local attacker can exploit these issues to gain superuser privileges. A successful exploit would lead to the complete compromise of affected computers.

This issue affects Apple Xcode 2.2 and earlier versions.

Apple Xcode OpenBase Multiple Privilege Escalation Vulnerabilities

The following exploit code samples are available:

• /data/vulnerabilities/exploits/20562-2.pl
• /data/vulnerabilities/exploits/20562.pl

Apple Xcode OpenBase Multiple Privilege Escalation Vulnerabilities

Solution:
Reports indicate that a fix may be downloaded directly from OpenBase International Ltd. Please see the references for more information.

Apple Xcode OpenBase Multiple Privilege Escalation Vulnerabilities

References:

• Apple Xcode (Apple)
  
• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• OpenBase SQL multiple vulnerabilities Part Deux (Kevin Finisterre)
  
• OpenBase Homepage (Openbase International, Ltd.)