Application Enhancer Local Privilege Escalation Vulnerability

Bugtraq ID:	21951
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 08 2007 12:00AM
Updated:	Jan 09 2007 08:20PM
Credit:	Discovered by LMH and Johnny Pwnerseed.
Vulnerable:	Unsanity Application Enhancer 2.0.2
Not Vulnerable:

Application Enhancer Local Privilege Escalation Vulnerability

Application Enhancer is prone to a local privilege-escalation vulnerability.

Local attackers can gain superuser privileges by patching the 'ApplicationEnhancer' binary or by replacing it. The 'aped' process is launched with root privileges, which enables privilege escalation if the 'ApplicationEnhancer' binary is maliciously modified.

Application Enhancer 2.0.2 running on Mac OS X 10.4.8 (8L2127) x86 is vulnerable to this issue; other versions may also be affected.

Application Enhancer Local Privilege Escalation Vulnerability

The following proof-of-concept exploit is available:

• /data/vulnerabilities/exploits/APE_local-exp.rb

Application Enhancer Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Application Enhancer Local Privilege Escalation Vulnerability

References:

• MOAB-08-01-2007: Application Enhancer (APE) Local Privilege Escalation (LMH and Johnny Pwnerseed)
  
• Vendor Homepage (Unsanity)