MacOS X SoftwareUpdate Vulnerability

From: Russell Harding (hardingrat_private)
Date: Sat Jul 06 2002 - 21:21:24 PDT

Next message: Adam Slattery: "sparc exploit for known solaris 8 kcms_configure overflow"

Previous message: noir sin: "Re: UnBodyGuard a.k.a Bouncer (Solaris kernel function hijacking) (fwd)"
Next in thread: Julian Suschlik: "Re: MacOS X SoftwareUpdate Vulnerability"
Reply: Julian Suschlik: "Re: MacOS X SoftwareUpdate Vulnerability"
Reply: jaehnelat_private: "RE: MacOS X SoftwareUpdate Vulnerability"
Reply: Hundley, Gordon - Princeton: "RE: MacOS X SoftwareUpdate Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------------
                    MacOS X SoftwareUpdate Vulnerability.
----------------------------------------------------------------------------

Date:      July 6, 2002
Version:   MacOS 10.1.X and possibly 10.0.X
Problem:   MacOS X SoftwareUpdate connects to the SoftwareUpdate Server via
           HTTP with no authentication, leaving it vulnerable to attack.

----------------------------------------------------------------------------

         http://www.cunap.com/~hardingr/projects/osx/exploit.html

----------------------------------------------------------------------------

Summary:

Mac OS X includes a software updating mechanism "SoftwareUpdate". Software
update, when configured by default, checks weekly for new updates from
Apple.  HTTP is used with absolutely no authentication. Using well known
techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to
trick a user into installing a malicious program posing as an update from
Apple.


Impact:

Apple frequently releases updates, which are all installed as root.
Exploiting this vulnerability can lead to root compromise on affected
systems. These are known to include Mac OS 10.1.X and possibly 10.0.X.


Solution/Patch/Workaround:

There is currently no patch available. Hopefully the release of this
information will convince apple they need, at the very least, some basic
authentication in SoftwareUpdate.


Exploit:  http://www.cunap.com/~hardingr/projects/osx/exploit.html

An exploit for this vulnerability has been released to the public for
testing purposes.  It is distributed as a Mac OS X package which includes
DNS and ARP spoofing software. Also, it includes the cgi scripts, and
apache configuration files required to impersonate the Apple
SoftwareUpdatesServer.


Credits:

Author  -  Russell Harding - hardingrat_private
Testing -  Spectre Phlux, KrazyC, Devon, and The Wench

Next message: Adam Slattery: "sparc exploit for known solaris 8 kcms_configure overflow"
Previous message: noir sin: "Re: UnBodyGuard a.k.a Bouncer (Solaris kernel function hijacking) (fwd)"
Next in thread: Julian Suschlik: "Re: MacOS X SoftwareUpdate Vulnerability"
Reply: Julian Suschlik: "Re: MacOS X SoftwareUpdate Vulnerability"
Reply: jaehnelat_private: "RE: MacOS X SoftwareUpdate Vulnerability"
Reply: Hundley, Gordon - Princeton: "RE: MacOS X SoftwareUpdate Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Jul 07 2002 - 16:29:36 PDT