Mac OS X writeconfig privilege escalation
Published:		22.01.2007
Source:		MOAB
SecurityVulns ID:		7089
Type:		local
Level:		7/10
Description:		launchctl utility is executed by relative path from suid application.

Affected:		APPLE : Mac OS X 10.4
CVE:		CVE-2007-0022 (Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a modified PATH that points to a malicious launchctl program.)

Original document

MOAB, MOAB-21-01-2007: System Preferences writeconfig Local Privilege Escalation Vulnerability (22.01.2007)

Files:		"Exploit" for MOAB-21-01-2007: OS X, making root shells easier each day.
Discuss:		Read or add your comments to this news (0 comments)