BID:7322

Apple MacOS X DirectoryService Privilege Escalation Vulnerability

Info

Apple MacOS X DirectoryService Privilege Escalation Vulnerability

Bugtraq ID:	7322
Class:	Input Validation Error
CVE:	CVE-2003-0171
Remote:	No
Local:	Yes
Published:	Apr 10 2003 12:00AM
Updated:	Jul 11 2009 09:06PM
Credit:	This issue was discovered by Dave G. <[email protected]>.
Vulnerable:	Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.0 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0

Not Vulnerable:	Apple Mac OS X Server 10.2.5 Apple Mac OS X 10.2.5

Discussion

Apple MacOS X DirectoryService Privilege Escalation Vulnerability

Apple MacOS X DirectoryService is prone to an issue which may allow local attackers to gain elevated privileges. This issue is due to usage of libc system() function to execute commands. Attackers may potentially set a PATH environment variable that causes an arbitrary file to be executed with elevated. Exploitation may require the attacker to abuse other known issues (BID 7323) to crash the service.

Solution / Fix

Apple MacOS X DirectoryService Privilege Escalation Vulnerability

Solution:
This issue is addressed in MacOS X 10.2.5. This update can be applied via the Software Update pane in System Preferences.

Apple Mac OS X Server 10.2