Apple Mac OS X AppleScript ARDAgent Shell Local Privilege Escalation Vulnerability

Bugtraq ID:	29831
Class:	Access Validation Error
CVE:	CVE-2008-2830
Remote:	No
Local:	Yes
Published:	Jun 19 2008 12:00AM
Updated:	Sep 16 2008 10:40PM
Credit:	anonymous
Vulnerable:	Apple Remote Desktop 3.2.1 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.5
Not Vulnerable:	Apple Remote Desktop 3.2.2

Apple Mac OS X AppleScript ARDAgent Shell Local Privilege Escalation Vulnerability

Mac OS X is prone to a local privilege-escalation vulnerability affecting ARDAgent (Apple Remote Desktop).

Successful exploits allow local attackers to execute arbitrary code with superuser privileges, completely compromising the affected computer.

This issue is confirmed to affect Mac OS X 10.5 versions; earlier versions may also be vulnerable.

Apple Mac OS X AppleScript ARDAgent Shell Local Privilege Escalation Vulnerability

The following exploit code is available:

osascript -e 'tell app "ARDAgent" to do shell script "whoami"';

NOTE: This issue is being exploited by the 'AppleScript.THT' trojan to gain elevated privileges. Please see the references for more information.

Apple Mac OS X AppleScript ARDAgent Shell Local Privilege Escalation Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for more information.


Apple Mac OS X 10.5.4

• Apple SecUpd2008-005.dmg
  For Mac OS X v10.5.4 and Mac OS X Server 10.5.4
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=20388&cat= 1&platform=osx&method=sa/SecUpd2008-005.dmg

Apple Mac OS X Server 10.5.4

• Apple SecUpd2008-005.dmg
  For Mac OS X v10.5.4 and Mac OS X Server 10.5.4
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=20388&cat= 1&platform=osx&method=sa/SecUpd2008-005.dmg

Apple Remote Desktop 3.2.1

• Apple RemoteDesktopAdmin322.dmg
  http://www.apple.com/support/downloads/


• Apple RemoteDesktopClient.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X AppleScript ARDAgent Shell Local Privilege Escalation Vulnerability

References:

• Mac OS X Root Escalation Through AppleScript (Slashdot)
  
• AppleScript.THT Trojan Horse (SecureMac)
  
• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)