SB2007010601 - Privilege escalation in Mac OS X

Description

This security bulletin contains information about 1 vulnerability.

1) Improper file permissions handling (CVE-ID: CVE-2007-0117)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Green

The vulnerability allows a local user to escalation privileges on vulnerable system.

The vulnerability exists in diskutil tool within DiskManagement framework when handling BOM files. A local user can create a specially crafted BOM file, run diskutil with specially crafted BOM file and replace permissions for arbitrary files on vulnerable system.

Successful exploitation of this vulnerability allows a local unprivileged user to elevate his privileges and gain root access to vulnerable system.

Note: the vulnerability is being actively exploited.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://jon.oberheide.org/moab/MOAB-05-01-2007.html
• http://rixstep.com/2/2/20070810,00.shtml