DrunkenBlog

But it's only a local root exploit

About 100 posts ago (2 months-ish), I posted about a local iSync vulnerability, and tried to give a reasonable explanation of what was going on as well as how to fix it until Apple released their own fix. I'm getting emailed about it because of a really fun usenet thread in comp.sys.mac.system, among other places (which are more amusing), that is linking to my post on it.

My original post gives all the info regarding the vuln, but suffice to say this isn't something that can harm you from someone acting remotely, but locally it's the real deal for escalating one's privileges and 0wning a box. 'Local' can also mean a lot of things:

• Someone sitting at a computer and but 'locked out' of other users, and other aspects of the system, can use it to do bad things.
• Someone in a remote location, but given an account on the system/server can use it to break out of their user-space and into everyones, among other things. This isn't as uncommon as you'd think, think about where your website is and how you access it.
• This is exactly the type of exploit a piece of malware loves to exploit to get access to the whole machine. Think of your kid downloading something bad off of P2P while in their account, and the malware author now has access to the spreadsheets in your account.

A remote-root is even more serious, and is the type of thing that allows someone to get in even though they've been granted no access whatsoever. This one is about someone being given access and using that foot in the door to totally take control. It's still a very serious thing, and is not harmless.

It is local, so it's not the end of the world, although I don't know if I'd be saying that if I was using a different platform. Not fixing something serious quickly because there theoretically aren't that many people looking to abuse it is basically a roll of the dice.

Now of course Apple is going to fix this eventually, they'd be stupid as hell not to, but two months is a pretty long time for a local root exploit to go unpatched, and it's good that there's little malware in existence for OS X.

Unfortunately for those emailing me, while we can guess about what's going on to hold things up (Are there multiple vulns in this class? Is it a deeper-rooted problem? Will the fix screw something up that has to be coded around? Are they being restricted by their scheduled releases for patches?), it's not the kind of thing we'll ever have an answer to.

Only Apple would, and they're pretty opaque about this kind of thing.

 Posted by drunkenbatman
    March 24, 2005, at 06:33 AM