Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mac OS X Buffer Overflow Found

Posted by ryuzaki0 on from the and-so-it-begins dept.

MacDork writes "Well, if default settings in Mac OS X made Lance Ulanoff excited, this is really going to make him do the monkey boy dance... SecurityFocus's Bugtraq mailing list just posted a buffer overflow, in the utility for mounting and probing ISO 9660 file systems. No exploits were mentioned. No word on whether 'Max' alerted Apple or anyone outside of the Bugtraq mailing list though." Also, 'Max' made entirely unfounded, sweeping statements about the general quality of Mac OS X from this one little item, but oh well. When you're on top, you make a tempting target.

161 comments

  1. Looks low risk to me... by MarkusQ · · Score: 5, Interesting

    From looking at the posting, I don't see any demonstration (or even any indication) that this is exploitable. What I see is that, if you put a goobered up CDROM in the drive (or use perl to simulate same)...

    ...it won't work.

    Yes, it might be possible to craft some clever exploit in the usual way, but that is by no means easy and is often impossible (depending mostly on what gets allocated around the buffer).

    And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway.

    -- MarkusQ

    1. Re:Looks low risk to me... by MSG · · Score: 4, Insightful

      The potential for exploit doesn't require you to insert a CD. It may be exploitable by command line arguments. If so, then there may be a vector for an attacker to begin privilege escalation if he can achieve access to a local account, in which case this would present a full root vulnerability to a remote user.

    2. Re:Looks low risk to me... by Anonymous Coward · · Score: 3, Interesting

      [Jonathan-Dobbies-Computer:/Users/jsdobbie] guest% /System/Library/Filesystems/cd9660.fs max$ ls -la cd9660.util
      su: /System/Library/Filesystems/cd9660.fs: Permission denied.

      makes me question it's usefulness even more

      If one has physical access to the machine, it isn't secure; everyone knows this

    3. Re:Looks low risk to me... by ag0ny · · Score: 5, Interesting

      And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway.

      That's not the way it works. The problem is a typical input validation problem in a setuid root binary. You don't need a CD. In fact, you don't even need physical access to the computer.

      This is a privilege scalation vulnerability. If exploitable, this means that someone with non-superuser access to the computer could exploit the (as of yet unconfirmed) vulnerabilty in this binary to gain superuser privileges.

      You must take into account that you don't need to be a local user in order to run this program. Some other vulnerability or misconfiguration can be used first in order to run an exploit against the cd9660.util binary.

      --
      My site
    4. Re:Looks low risk to me... by Anonymous Coward · · Score: 1, Interesting

      -- And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway. --

      There is an open firmware password utility for all firmware Macs (I.e. post-Beige, Jobs era) that will require a password to boot from a CD or anything other than the primary boot drive.

      Most Mac towers have a locakble cases also in case you are extra paranoid. ;)

    5. Re:Looks low risk to me... by klui · · Score: 3, Interesting

      Maybe you're running Jaguar or some other version of OS X. Panther 10.3.1 has the directory world readable and I was able to reproduce the seg fault.

    6. Re:Looks low risk to me... by Micro$will · · Score: 2, Informative

      I have Jag (10.2.8) and was able to do it as a non-admin user.

    7. Re:Looks low risk to me... by You're+All+Wrong · · Score: 5, Interesting

      "I don't see any demonstration (or even any indication) that this is exploitable."

      Then what the fuck is "#2 0x41414141 in ?? ()"?

      To me, that looks like user data in the stack frame.
      To me, that means that an arbitrary jump can be executed.
      To me, that means that arbitrary NUL-less code can be executed.

      And the chances of there existing NUL-less BSD PPC shell-code are what, you ask?

      Here's your answer -
      0x7CC63278, 0x2F867FFF, 0x41BC005C, 0x7C6802A6,
      0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4,
      0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14,
      0x7CC419AE, 0x7C8429D6, 0x7C842214, 0x7C043A14,
      0x7CE72850, 0x7C852A14, 0x7C63212E, 0x7C832214,
      0x7CC5212E, 0x7CA52A78, 0x44FFFF02, 0x7CE03B78,
      0x44FFFF02, 0x4BFFFFA9, 0x2F62696E, 0x2F73685A,
      0xFFFFFFFF, 0xFFFFFFFF

      All someone's got to do is calculate the offset for the overwritten return stack to contain such that it calls the above code. That could be calculated with just 2 more probes with perl - use 'abcdefghijklmnopqrstuvwxyz' x 20 and 'abcdefghijklmnopqrstuvwxyz123456789' x 16
      and tell me the values read off the stack.

      If anything you should be thankful that 'Max' didn't publish real live exploit code, as then the script kiddies would be doing their best to run it already. At least this way they need to still fill in the gaps. Gaps that unfortunately I've just had to explain on a very public forum because a Mac user had his head in the clouds.

      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
    8. Re:Looks low risk to me... by MyDixieWrecked · · Score: 2, Informative
      up to and including installing an old copy of BeOS over OSX anyway.

      Well, BeOS doesn't run on any G3/G4/G5. Only original PowerMacs (601/603/603e/604/604e).

      OSX only runs on NewWorld G3s and newer, so pretty much BeOS wouldn't be a threat, there. ;)

      Linux on the other hand........

      --



      ...spike
      Ewwwwww, coconut...
    9. Re:Looks low risk to me... by Anonymous Coward · · Score: 2, Funny

      We're talking about OS X here, not Windows. There are no script kiddies.

    10. Re:Looks low risk to me... by You're+All+Wrong · · Score: 1

      WTF has the far end's OS got to do with script kiddieness?
      Are you getting confused by the fact that there are two parties involved in such an attack -- the script kiddie and the victim? DO you think that these two parties need to be running the same OS? Do you find yourself accidentally hacking or DoSsing your own system sometimes?

      The level of ignorance that you display is part of the problem.

      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
    11. Re:Looks low risk to me... by guuyuk · · Score: 2, Funny

      Besides, most people would look for an eject button on the CD drive. The last Mac that I saw that had that was a Beige G3.

      (For the humor impaired, it's supposed to be a joke)

      --
      We're sorry, the phone number you have reached is imaginary. Please rotate your phone 90 degrees and try your call again
    12. Re:Looks low risk to me... by freerangegeek · · Score: 5, Insightful

      Excuse me, but to execute a mount I have to at least have a shell on the affected machine, right? I may not need console access, but I do need shell access.

      And, by default, the firewall is ON, and sshd is disabled, so 'by defualt' I do need local access. And to execute a 'shell capable' program I can't just mail an attachment to the user, the user has to actively open it.

      Admittedly, this is a serious problem that needs fixing, but this won't be narachi, codered, etc. I'll bet you we have a fix in less than 2 weeks available for download via the system update command. (probably less)

      Lee

    13. Re:Looks low risk to me... by b1t+r0t · · Score: 3, Informative
      And the reason NUL-less shellcode is even possible under OS X is that it ignores the middle two bytes of system call instructions. (The high byte is the system call instruction, and the low byte is used for the system call number.)

      Way to go, Apple. (Actually, this probably dates back to NeXT.)

      --

      --
      "Open source is good." - Steve Jobs
      "Open source is evil." - Microsoft
    14. Re:Looks low risk to me... by You're+All+Wrong · · Score: 1

      Thanks for that extra tidbit. The quantity of hoop-jumping in that shellcode was quite minimal, and you've mostly explained why that was possible. However, even the PPC linux equivalent wasn't much longer.
      I think that the DEC Alpha and Sparc shellcodes that I've seen have been the most contrived. (I saw one where almost every instruction needed to be modified!)

      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
    15. Re:Looks low risk to me... by Jesrad · · Score: 4, Informative

      2 weeks ? Why wait ? Get the fix for this vulnerability, and another similar one freshly discovered, from here.

      --
      Maybe we deserve this world ?
    16. Re:Looks low risk to me... by norkakn · · Score: 1

      G5 with panther

  2. wtf by prockcore · · Score: 2, Interesting

    When you're on top, you make a tempting target.

    I see, so you buy into the argument that MS is only targetted because it's so popular?

    I'm always amazed at how fast Mac users will resort to MS-style tactics and excuses.

    1. Re:wtf by Anonymous Coward · · Score: 0

      on top of what? one might ask....

    2. Re:wtf by hype7 · · Score: 4, Insightful
      I'm always amazed at how fast Mac users will resort to MS-style tactics and excuses.


      The difference is that Apple, unlike Microsoft, provides timely patches. Not timely excuses.

      -- james
    3. Re:wtf by idontsmoke · · Score: 2, Insightful
      I'm always amazed at how fast Mac users will resort to MS-style tactics and excuses.

      The difference is that Apple, unlike Microsoft, provides timely patches. Not timely excuses.

      No, the difference is the grandparent poster quoted out of context. Pudge was referring to the "entirely unfounded, sweeping statements about the general quality of Mac OS X" that 'Max' made while reporting the bug, he wasn't trying to play down the fact a bug exists.

    4. Re:wtf by Anonymous Coward · · Score: 0

      WHAT sweeping statements? Max said some of the non-unix code was bad quality, and he proved it. It's not like he said Steve Jobs was like Hitler or Mac OS X was a cancer, or anything the other OSes deal with on a daily basis back in the real world....

    5. Re:wtf by Anonymous Coward · · Score: 0

      Don't you mean boyfriend?

    6. Re:wtf by llf4nlp · · Score: 1

      Saying 'When you're on top, you make a tempting target.' does not, logically, imply that the only reason MS is targeted is because it's popular. It's also targeted because it's easy, and makes a big splash. Given that Mac OS X is clearly more secure that MS - and yes, you could say that doesn't take much - it does become a more attractive target for those that want to denigrate a good OS. Is it perfect? No, but neither is Linux, or AUX, or Solaris, or.....

  3. Harsh, but not incorrect by MSG · · Score: 5, Interesting

    "Max" was definitely harsh, but he's not entirely out of line. cd9660.util *is* a SUID binary, and one would expect educated developers to take that into account and carefully validate any and all input. It's just what you *do* in a SUID program.

    This type of attack is nothing new, and this vulnerability may be an indication that security isn't being taken seriously.

    So... Darwin users/developers. Does this problem affect the open source Darwin? Just how many SUID binaries do you find on Darwin?

    1. Re:Harsh, but not incorrect by zangdesign · · Score: 2, Informative

      This type of attack is nothing new, and this vulnerability may be an indication that security isn't being taken seriously.

      Or possibly that these developers are delving into a new area where they don't have all the answers yet. I expect that there will be many more security issues found - it's the nature of the game when building something new or something old in a new way. It happens; you fix it and move on.

      Or you take the Max alternative - burn your bridges and execute any developer and his/her family and friends as they try to escape.

      --
      To celebrate the occasion of my 1000th post, I will post no more forever on Slashdot. Goodbye.
    2. Re:Harsh, but not incorrect by brass1 · · Score: 4, Informative

      > So... Darwin users/developers. Does this problem affect the open source Darwin?

      Well, for one, it made it easier for me to find the issue in the source tree: <a href="http://cvs.opendarwin.org/index.cgi/isoutil/ cd9660.util_main.m?rev=1.1.1.6&content-type=text/x -cvsweb-markup&cvsroot=apple">here</a>)

      i nt main( int argc, const char *argv[] )
      {
      const char *myActionPtr;
      int myError = FSUR_IO_SUCCESS;
      char myRawDeviceName[256];
      char myDeviceName[256];
      int mnt_flag;

      /* Verify our arguments */
      if ( (myError = DoVerifyArgs( argc, argv, &mnt_flag )) != 0 )
      goto AllDone;

      /* Build our device name (full path), should end up with something like: */
      /* /dev/disk1s2 */
      strcpy( &myDeviceName[0], DEVICE_PREFIX );
      strcat( &myDeviceName[0], argv[2] ); <======

      Now.. I personally wouldn't have used strcat in this case, strncat is your friend. One also notes DoVerifyArgs(), which does check the length of argv[2]:

      /* Make sure device (argv[2]) is something reasonable */
      myDeviceLength = strlen( argv[2] );
      if ( myDeviceLength < 2 )
      {
      goto ExitThisRoutine;
      }

      Sigh.. to make sure it's not too short. I've seen worse, but I have also had a CS 202 prof who would fail a student for this kind of thing.

      [ Three cheers for the paranoia in slash that made this post nearly impossible ]

    3. Re:Harsh, but not incorrect by dzerkel · · Score: 1

      strncat() is junk. Use strlcat() (and strlcpy()).

      Danny

      --
      "What's the point of going abroad, if you're just another tourist..."
    4. Re:Harsh, but not incorrect by Anonymous Coward · · Score: 0

      strcat() is junk but not strncat(). In this case, strncat() would have prevented this.

    5. Re:Harsh, but not incorrect by RatPh!nk · · Score: 2, Interesting

      What made the comment out of line was his remark that any code that did not come from the FreeBSD side of the road was of poor quality.

      -ph!nk

      --
      Argh. The laws of science be a harsh mistress.
    6. Re:Harsh, but not incorrect by Anonymous Coward · · Score: 0

      Actuallly, they are both junk. strcat() would have worked fine in this situation if the programmer remembered to perform input validation and did it correctly in DoVerifyArgs. For example, if argv[2] and DEVICE_PREFIX were long enough to overflow the buffer, then you could exit, truncate argv[2] or whatever was appropriate. Using strncat() forces essentially the same verification to be performed at the point where you are manipulating the strings. This removes the possibility of forgeting the validation, but still leaves the numerous errors that could arise if you screw up the validation.

    7. Re:Harsh, but not incorrect by MSG · · Score: 2, Interesting

      You could also drop the length checks entirely, and stat the file indicated by the arg. If it's a block device, the arg is valid.

  4. No exploit by jsse · · Score: 0, Redundant

    No exploits were mentioned.

    ...and no one bother....

  5. What! by Anonymous Coward · · Score: 2, Insightful
    Also, 'Max' made entirely unfounded, sweeping statements about the general quality of Mac OS X from this one little item, but oh well. When you're on top, you make a tempting target.

    Huh? How do you figure this? All he said was that parts of MacOSX that didn't come from BSD were not very well written. Whoopdeedoo - any operating system of that size will be likely to have some not so great code in it. It's beyond me how you managed to interpret Max's comment as an 'unfounded, sweeping statement' about the quality of MacOSX, given that 'parts' is a rather indeterminate quantity.

    1. Re:What! by pudge · · Score: 4, Informative

      All he said was that parts of MacOSX (sic) that didn't come from BSD were not very well written.

      Because it implies anything written in Mac OS X may be written poorly, while nothing from BSD is. Note that the majority of security fixes lately in Mac OS X, that I recall, were in BSD code (esp. ssh). I'm not criticizing ssh or BSD or anyone, it's just a stupid statement for the guy to make. Fine, it's a bug, no need to attempt to impugn Apple's programmers over it. I've said similar statements about people who criticized the ssh crew's code, or abilities, when a new bug is found.

  6. You aren't doing a thing for Apple's image by 0x0d0a · · Score: 4, Insightful

    Blind, stupid fanaticism doesn't do anything to help Apple -- it just means that people ignore Mac fans.

    MacDork writes "Well, if default settings in Mac OS X made Lance Ulanoff excited, this is really going to make him do the monkey boy dance... SecurityFocus's Bugtraq mailing list just posted a buffer overflow, in the utility for mounting and probing ISO 9660 file systems. No exploits were mentioned. No word on whether 'Max' alerted Apple or anyone outside of the Bugtraq mailing list though." Also, 'Max' made entirely unfounded, sweeping statements about the general quality of Mac OS X from this one little item, but oh well.

    I've seen *tons* of vulnerability releases about companies that contain harsh criticism of their security policies. This is not unusual. At the least, Apple screwed up on an important utility. They can take their lumps, same as everyone else does when they screw up.

    When you're on top, you make a tempting target.

    Apple isn't "on top" of much of anything that I can think of. Small/midrage servers? That's Linux-dominated. Workstations? That's Windows-dominated. I suppose they have more users than the other BSD variants, for what that's worth.

    Frankly, "Max" may be biased. I suspect that he's mostly right -- that the hammered-on and designed-by-folks-with-security-experience BSD code is more reliable than the new stuff Apple churned out. I do know that "MacDork" definitely *is* biased.

    I wish editors would reject stories that are just blatently biased, or at least reserve the right to re-summarize story submissions.

    --
    May we never see th
    1. Re:You aren't doing a thing for Apple's image by steeviant · · Score: 5, Insightful

      Apple isn't "on top" of much of anything that I can think of. small/midrage servers? That's Linux-dominated. Workstations? That's Windows-dominated. I suppose they have more users than the other BSD variants, for what that's worth.

      Or more users than all of the other Unix systems put together if you're talking about the desktop.

      Apple sell more Unix than any other vendor in the world at the moment, so they are on top in at least one respect.

    2. Re:You aren't doing a thing for Apple's image by Anonymous Coward · · Score: 0

      I took the claim that the Mac is "on top" is a sarcastic reference to the "security by obscurity" comments. After all, we are told that Macs are secure because they don't have much marketshare. Regardless of whether this is true or not, if we have a serious exploit on our hands, OS X is not secure in at least one respect -- hence, must not be obscure -- hence, the "on top" reference.

    3. Re:You aren't doing a thing for Apple's image by Anonymous Coward · · Score: 0

      > I seriously doubt that. Ever heard of linux? Ever hear of GRAPHICS? > Yeah, on top in commercial desktop unices. No, on top in commerical non-microsoft desktops.

    4. Re:You aren't doing a thing for Apple's image by 47PHA60 · · Score: 1

      Blind, stupid fanaticism doesn't do anything to help Apple -- it just means that people ignore Mac fans.

      "Max" does in fact make unsubstantiated statements about the quality of the software based on a single discovery, not to mention that he does not say that he notified Apple about the problem. Way to help improve a bad situation!

      Apple isn't "on top" of much of anything that I can think of.

      But they are on top; they make the best desktop OS out there, far better than anything Microsoft, Linux, or the BSD's have put out as a general workstation. Every media outlet is raving about the functional simplicity of the software. In a recent PC Magazine poll (and this in a rag with an editorial policy of dumping on Apple all the time) Apple's support and product quality tied or beat Dell, Gateway and IBM in every category. I think that the "on top, tempting target" remark is meant more in the way of saying that some people like to insult that which is perceived to be the best.

      I wish editors would reject stories that are just blatently biased, or at least reserve the right to re-summarize story submissions.

      And I wish the editors would send me a million dollars. Were you injured in some way by reading the story? Has your doctor warned you to avoid all excitement? Why not reserve your right to stop reading slashdot? That would be a lot easier than assigning someone to make sure that everything published is fit for your consumption.

    5. Re:You aren't doing a thing for Apple's image by MacDork · · Score: 2, Interesting

      I wish editors would reject stories that are just blatently biased, or at least reserve the right to re-summarize story submissions.

      You've got me, I'm definitely biased. I think Apple is the greatest thing since sliced bread.

      However, on the note of editorializing, who says they don't? My submission was exactly like my post except it used the 'monkey boy dance' line rather than 'wet dreams' line. I felt it was more appropriate for a general /. crowd :-) For the record, I have also posted this to bugreporter.apple.com just in case they were in the dark about it.

    6. Re:You aren't doing a thing for Apple's image by Anonymous Coward · · Score: 0

      Or more users than all of the other Unix systems put together if you're talking about the desktop. You're wrong

    7. Re:You aren't doing a thing for Apple's image by Anonymous Coward · · Score: 0

      If you need a reason to hack a Mac, you need look no further than Apple's Pro video application suite to find a goal: getting digital copies of pre-release movies while they are still being edited.

    8. Re:You aren't doing a thing for Apple's image by macdaddy · · Score: 3, Informative
      "Frankly, "Max" may be biased. I suspect that he's mostly right -- that the hammered-on and designed-by-folks-with-security-experience BSD code is more reliable than the new stuff Apple churned out."

      Apple didn't "churn it out." It's derived from OpenStep Workspace Manager as anyone with any relevant knowledge of OS X would know. Hell it even states in it the man page:

      Derived from the Openstep Workspace Manager filesystem utility programs.

      "I do know that "MacDork" definitely *is* biased....I wish editors would reject stories that are just blatently biased, or at least reserve the right to re-summarize story submissions."

      Why would the Slashdot folks do something so stupid? All of their articles are biased. It's that biasness that gives whiny little wish-I-knew-it-all people such as yourself a place to bitch and moan and make people think you're smart.

      Your village called. They want their idiot back. Shoo. Go on now. Shoo.

    9. Re:You aren't doing a thing for Apple's image by aftk2 · · Score: 2, Informative

      I seriously doubt that. Ever heard of linux?

      Ever heard of...(ahem)...

      Adobe Photoshop, After Effects, InDesign, Illustrator, Acrobat, Logic Audio Platinum, Digidesign Protools, Macromedia Flash, Fireworks, Dreamweaver, Freehand, Apple Final Cut Pro, DVD Studio Pro, Shake, QuarkXPress, Microsoft Word, Excel, Powerpoint, Propellerheads Reason, TC Spark, Ableton Live, Corel Painter, Avid Xpress, Symphony, Media Composer ...

      ...to name a few.

      These are programs which people use every day to get work done. They are available on Mac OS X. They are not available on Linux.

      Apple used to hold an important niche in the DTP market. Maybe they still do. At least, it's a more important market then commercial desktop unices...

      Agreed. Being on top in commercial desktop publishing, graphic design, professional video and audio is much more important than being on top in commercial desktop unices.

      --
      concrete5: a cms made for marketing, but strong enough for geeks.
    10. Re:You aren't doing a thing for Apple's image by geoffspear · · Score: 5, Funny
      I wish editors would reject stories that are just blatently biased

      Well, that would pretty much leave Slashdot with the Science and Ask Slashdot categories, and nothing else. Show me a fair and balanced story about SCO or RIAA.

      --
      Don't blame me; I'm never given mod points.
    11. Re:You aren't doing a thing for Apple's image by One+Louder · · Score: 3, Interesting
      Apple isn't "on top" of much of anything that I can think of.
      I suspect he meant "on top" with regard to the lack of exploited security vulnerabilities. Nobody I know running MacOS X has ever had their machine actually compromised.

      Certainly this makes the OS a bigger target for fanboys of other operating systems trying to be the first to "prove" that Macs are somehow equally insecure.

    12. Re:You aren't doing a thing for Apple's image by 0x0d0a · · Score: 1

      You've got me, I'm definitely biased. I think Apple is the greatest thing since sliced bread.

      That's not my point -- you are certainly entitled to be biased. We all are. The problem is that the &story submission*, which should be reasonably objective, is very heavy with bias. For example, I don't like Microsoft much. However, when I submitted a story about them, I kept it pretty factual and free of inflamatory content. I had plenty of nasty comments...but I stuck them down in the comments section, where they ought to be.

      --
      May we never see th
  7. In All My Years... by Bloodmoon1 · · Score: 4, Insightful
    On OS X, about 2 of them, actually, I've seen 1 bug that COULD have posed a problem for me. Maybe I'm just not as big of a power user as I think I am, but I really fail to see how virtually any of the bugs/exploits/whatever that are found for OS X are any type of problem. Yes they need patched, but they almost don't seem worth mentioning except for the sheer novelty of it, and maybe as some sort of strange inferiority complex kick for Windows users, as a recent article seems to suggest.

    Take this one for example, which many considered to be a "big security issue". Basically it only was a problem:
    1. On laptops.
    2. When someone had sudo running in Terminal.
    3. When the computer was put to sleep.
    4. For 10-20 SECONDS after the computer was woken up, but before the clock was updated, someone with physical access to the computer could execute code.
    What a massive, gaping, goatse proportioned hole. Who knew it was a bad idea to leave your computer running sudo just laying around in Starbucks while you went to the can? And Apple still had a patch out in a week or two. And in 10.3, passwords can be required to wake the computer, further negiating this and any similar problems.

    Now compare that to the 50 critical security fixes needed immediately for an install of a year old Windows XP disk. And the fact that there are about a hundred different ways to execute code in Windows, either legitimate or malicious, all across the system, even in the damn web browser.

    Basically what I'm getting at here is that this is newsworth simply for the fact that it really isn't. I'd be willing to bet 0 people will have any problem with this before it is patched.

    And on a personal note, "Max" sounds pretty fucking stupid and ignorent. "It appears that parts of MacOSX that didn't come from BSD are not very well written and have significant security issues." Oh boy! I found a buffer overflow that will effect no one and that I probably didn't even bother to inform Apple about before hand! I'm a L337 haX0r bitches! Now if he just would have thrown in something about how Apple is beleaguered and BSD is dying, we could just chaulk up "Max" as a lucky troll.
    --

    Request: ECM unit, 1000 km fullerene cable, 1 tactical nuclear weapon. Reason: Birthday party for foreign dignitary.
    1. Re:In All My Years... by Huge+Pi+Removal · · Score: 1

      Yes, most OS X security vulns are pretty low-key, certainly from a desktop point of view. But it was a slight mistrust of Apple security that made me go for vanilla BSD for our main public servers, and leave our (rather nice) XServes inaccessible behind a strong firewall. Now I feel vindicated - potential privilege escalation on a public server gives me the shivers.

      --
      - Oliver

      The right to bear arms is only slightly less stupid than the right to arm bears...
    2. Re:In All My Years... by Anonymous Coward · · Score: 0
      Now compare that to the 50 critical security fixes needed immediately for an install of a year old Windows XP disk. And the fact that there are about a hundred different ways to execute code in Windows, either legitimate or malicious, all across the system, even in the damn web browser.

      Umm. I just checked security focus' vulnerability database. In the past year, Apple has had 78 different security holes. By your numbers, that means that Windows is more secure.

      I don't believe it to be less secure than Windows but I'm sick of Apple users spouting their nonsense about how Mac OS X is the be all and end all of operating systems. It's not perfect. It has security holes. It has user interface issues. Deal with it.

    3. Re:In All My Years... by Bloodmoon1 · · Score: 3, Insightful

      50 is a kind of randapher guess I took. I'm sure it would be more if I went and actually bothered to check, but I don't really care. If Apple (OS What? Details son, details) has had 78 holes, Microsoft has probably had about 8 million. Besides, who cares? We all know MS systems are less secure than Apple systems. No news there. Stop trying to defend against every anti-MS comment, it's to much work for a person to do. Besides, I said 50 critical fixes. I guarantee there haven't been that many critical fixes to OS X.

      And I'm well aware, as are virtually all Mac users, that we don't have the perfect OS by any means. It has it's issues. All of them do. Just ours has fewer issues than almost all others (especially compared to our user base), is probably the easiest to use (approx. 10 years of usage, never had to even deal with device drivers) and learn, has a decent amount of software support, has 0 viruses (besides the ones that affect all Microsoft products on all platforms), and is by far and away just the nicest looking. No one ever said it was perfect. Jaguar was the same way. And it's better now in Panther. And OS X will be better still in 10.4, and then 10.5, and so on. Things are as good as they ever have been, but they can only get better from here.

      On a totally unrelated note, I'm updating my post reply policy for ACs.

      --

      Request: ECM unit, 1000 km fullerene cable, 1 tactical nuclear weapon. Reason: Birthday party for foreign dignitary.
    4. Re:In All My Years... by Anonymous Coward · · Score: 1, Funny

      Yeah, watch out for that remote exploit that walks into your office and puts a CD-ROM in the drive!

    5. Re:In All My Years... by Huge+Pi+Removal · · Score: 1

      As loads of people point out, this *is* remotely exploitable. It's just a setuid binary that doesn't validate its input correctly.

      --
      - Oliver

      The right to bear arms is only slightly less stupid than the right to arm bears...
    6. Re:In All My Years... by b1t+r0t · · Score: 3, Interesting
      As loads of people point out, this *is* remotely exploitable.

      No. Unless your definition of "remotely exploitable" includes the words "already has a shell account on the system". My definition doesn't.

      --

      --
      "Open source is good." - Steve Jobs
      "Open source is evil." - Microsoft
    7. Re:In All My Years... by Huge+Pi+Removal · · Score: 2, Informative

      The point is privilege escalation. If there's a hole in one of your services (as there are, from time to time), it won't hurt you too much if, say, an intruder is roaming around as an unprivileged user, such as www or nobody. If they can exploit a setuid binary to give themselves a backdoor, change accounts, basically do anything root can, then that's a hell of a lot worse.

      Security comes in layers. I want as many layers as possible.

      --
      - Oliver

      The right to bear arms is only slightly less stupid than the right to arm bears...
    8. Re:In All My Years... by meta-monkey · · Score: 1

      Yes, that is the point. However, you don't seem to understand the definition of a remote exploit. A remote expoit requires that you not already be logged into the computer. This is a local exploit.

      --
      We don't have a state-run media we have a media-run state.
    9. Re:In All My Years... by HTH+NE1 · · Score: 1

      Well, it's easy to get confused when a LAN exploit is given the "remote" label.

      There are many layers to the security onion. "Local" and "remote" are often insufficient to describe which layer has the vulnerability. Not everyone knows what locus to which they are relative.

      Not a correction; an observation.

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    10. Re:In All My Years... by tgibbs · · Score: 1
      No. Unless your definition of "remotely exploitable" includes the words "already has a shell account on the system".
      ...or who happens to see a random user's password unwisely written on a post-it note attached to his monitor.
    11. Re:In All My Years... by zygote · · Score: 1
      Take this one for example, which many considered to be a "big security issue". Basically it only was a problem:
      • On laptops.
      • When someone had sudo running in Terminal.
      • When the computer was put to sleep.
      • For 10-20 SECONDS after the computer was woken up, but before the clock was updated, someone with physical access to the computer could execute code.
      ...Who knew it was a bad idea to leave your computer running sudo just laying around in Starbucks while you went to the can?
      Condsidering the diffculty of breaking into OS X with these sort of holes, a cracker would probably have to steal the laptop from the Starbucks to have enough time achieve root access. D'oh!
      --
      the future is here, it is just not evenly distributed - w. gibson
    12. Re:In All My Years... by Jesrad · · Score: 1

      But that would make it a LOCAL exploit then, wouldn't it ? Or does your definition of "remote" means being _behind_ the keyboard ? ;)

      --
      Maybe we deserve this world ?
  8. Look, pudge.. by molo · · Score: 1, Interesting

    Pudge, you have to realize that Apple has no experience when it comes to the world of Unix security. MacOS (=9) hasn't traditionally been the target of as much scrutiny, and it doesn't have things like SUID binaries that will turn a simple bug into a security problem. Apple needs to play catchup for a while.

    -molo

    --
    Using your sig line to advertise for friends is lame.
    1. Re:Look, pudge.. by Neillparatzo · · Score: 1

      MacOS equals nine didn't traditionally have things like multiuser security, process separation, paged memory management, or... anything. SUID binaries? In a way, they all were. Hell, you could freeze the OS just by holding the mouse button down.

    2. Re:Look, pudge.. by pyrotic · · Score: 4, Informative

      you have to realize that Apple has no experience when it comes to the world of Unix security.

      They weren't great, but then who was back in the day.

      Next were developing their unix since 1988, and Apple merged with them in 1998. Apple's current CTO is formerly of Next

      A/UX, Apple's unix, ran on M68030 Macs in 1989

      AIX, IBM's unix, ran on the PPC604 Newtork Servers in 1996

      MK/Linux, Apple's Mach/Linux hybrid, ran on PPC Macs in 1996

      MacOSX server has been going since 1999.

    3. Re:Look, pudge.. by MouseR · · Score: 4, Interesting

      Apple has no experience when it comes to the world of Unix security.

      Er... this Mac OS X that Apple has... including all of it's developers... actually are NeXT's OpenStep (and NeXTSTEP before that) and NeXT employees that built the thing in the first place. In the late 80s.

      Apple's got a pretty good idea of how Unix works.

      There have been exploits found in Apache before. That does not imply Apache developers don't have a clue about web servers.

      So, if an exploit has been found, it's only because it wasn't found before. There has been exploits for Linux, and I'm sure there will be more, like there will be more Mac OS X exploits to be found.

      It's how Apple and the Linux community handles found exploits that matters. And how MS doesn't. unfortunately.

    4. Re:Look, pudge.. by Llywelyn · · Score: 1

      You do realize that this was in the Open Source part of MacOS X, right?

      --
      Integrate Keynote and LaTeX
  9. Re:Look, pudge.. defcon4 apple apologist alarm! by Anonymous Coward · · Score: 0

    Look at you. Trying to reason with Pudge. Blaming him for rporitng on Apple's inexcusable failure.

    Dude, they have fucking Jordan Hubbard, the father of FreeBSD working there. There is not one tiny iota of a bit of an excuse for this. Not one. Its pathetic you defend them.

    Apple needs to play catchup? What are you talking about. They've always had to. They've always had a decreasing market share. Part of this has to do with this brilliant/stupid person Steve Jobs/Jobs Steve is. He is intelligent but woefully incomplete at the same time, saying both intelligent and utterly stupid and outrageous things at the same time.

    Put it to you tihs way: You pay for Steve Job's jet in ridiculous hardware premiums for inferior hardware. While Jordan Hubbard, the brains of the operation, gets peanuts. I'm sure Jordan's asked 1000 times for more real resources and less arts students designing stupid fake switch commercials and deformed speakers and brushed metal cases Lian Li and others had fo PCs millenia ago.

    So OS X cant be wrong. Not even with Darwin as a staging ground Not even with the father of FreeBSD on board? Lets face it the error was out of hand. No excuses.

  10. When OSX becomes popular... by eyeball · · Score: 5, Insightful

    Unfortunately, when OSX becomes popular enough, it will become a huge security target. But it won't be security exploits that pose a problem, it will be the same problems that plague Windows today:

    Just like in the Windows world, it's social engineering that causes installation and execution of quasi-legal applications like Comet Cursor and Bonsai Buddy, as well as downright unethical and illegal programs (virus and worms) that get installed when a user is told "click on the .exe to see boobies." No type of security can possibly stop that type of human behavior (being an IT I'm convinced that education, warnings, and even threats can't stop it).

    --

    _______
    2B1ASK1
    1. Re:When OSX becomes popular... by dema · · Score: 3, Funny

      Unfortunately, when OSX becomes popular enough

      Lucky for us Mac users, that will never happen :D

    2. Re:When OSX becomes popular... by McAddress · · Score: 3, Funny

      it can't become popular b/c it is built on BSD, and BSD is dying. Or b/c Apple is dying. 2 for the price of one.

    3. Re:When OSX becomes popular... by Durindana · · Score: 2, Funny

      ... then people who have never used it will understand the importance of requiring admin password entry before installing anything.

      That's why you don't, and won't, see malware on OS X - when the machine demands a password for some shite you think is dodgy, people stop and squint; they don't just click the big button that says 'Yes! Show me boobies!'

    4. Re:When OSX becomes popular... by commodoresloat · · Score: 1

      If OSX becomes popular, only popular people will use OSX.

  11. Probably flamebait but I can't resist by captainkibble · · Score: 3, Funny

    Reaction to bug/vunerablity/error reports: Windows User: Ahhh crap another bug/vunerablity/error how long shall I have to wait till that gets patched Linux User: Ahhh crap another bug/vunerablity/error better get the patch Mac OS User: What bug/vunerablity/error? There have never been any bugs/vunerablities/errors in Mac OS. Mac OS bugs/vunerablities/errors are just Windows propoganda. The bugs/vunerablities/errors are throwing themselves against the city walls. We are killing them!

    --
    Warning! This post may contain a pun!
    1. Re:Probably flamebait but I can't resist by Anonymous Coward · · Score: 0

      Actually, with most Mac users it's "my weekly update has a security update... you mean there used to be a security bug? Hhuh. Good thing I use an OS that responds with patches quicker than users like me are likely to even hear about them. Hey look, Wired is reporting that another worm is taking entire Windows-using offices off-line. Gosh, I wonder what that feels like..."

  12. strcat by rixstep · · Score: 1

    It's kindergarten defensive coding: anyone with even less than half a brain does not use strcat without first being DAMN sure the destination's got enough room.

    This is a beginner's mistake, aka Microsoft Mistake.

  13. Ehh.. it don't work for me. by yancey · · Score: 1

    I have MacOS 10.3.1 and tried cut-and-pasting his command line and got the Segmentation fault, but no root prompt. Perhaps Max is using an older version of the OS?

    --
    Ouch! The truth hurts!
    1. Re:Ehh.. it don't work for me. by GMontag451 · · Score: 4, Informative
      Read, comprehend, post, generally in that order.

      The command line was just a demonstration of the vulnerability, not exploit code. All it was supposed to do was segfault. The attached gdb output shows that the 'A's overwrote one of the return addresses on the stack frame. That means it might be possible to jump to an arbitrary memory address and execute code, as root I might add.

  14. Didn't work for me either by sergeiyak · · Score: 1, Informative

    I have Mac OS X 10.2.8 (Jaguar) and I wasn't able to reproduce the behaviour described in Max's security post. It *does* throw a segmentation fault, but nothing happens afterwards. Neither it writes a core dump file, nor does it give any root privileges. Did someone with an older system try that? I can't find any confirmations that the issue exists. Thanks.

    1. Re:Didn't work for me either by Anonymous Coward · · Score: 0

      so you don't know what a shellcode is, right ?

    2. Re:Didn't work for me either by Fulkkari · · Score: 3, Informative
      nor does it give any root privileges

      No. That command wasn't meant to give you root privileges; it was just a demonstration that there *is* a buffer overflow in this program. Makes me wonder why anyone hasn't noticed/told about this earlier. There is quite many set-uid and set-gid programs in OS X (I have 79), so maybe people have been lazy finding these things. This is hoply going to change some of that.

      To check your set-uid and set-gid programs, use:
      find / -perm +6000 -print

      Neither it writes a core dump file

      From man core:

      NOTE

      Core dumps are disabled by default under Darwin/Mac OS X. To re-enable core dumps, a privlaged user must edit /etc/hostconfig to contain the line:

      COREDUMPS=-YES-
      --
      I demand the Cone of Silence!
    3. Re:Didn't work for me either by Anonymous Coward · · Score: 0

      >Neither it writes a core dump file, nor does it give any root privileges

      Wow. A guy tells you your door's wide open, and you don't believe him because noone came inside (yet). Comprehend the article before saying something stupid.

  15. sarcasm by zerosignull · · Score: 2, Insightful

    "When you're on top, you make a tempting target." I beleve it was ment as a sarcastic pun. After the recent plaming from other articles sayin that mac os x would have more holes found in it 'if' it were on top. This is s prity hard to exploit bug though. "Persuming" that u can execute malitious code think of the steps you would have to go through to get to actuallly execute the buged program? If by the time you can execute command line argument's then the OS is in trouble cause ne thing can be done. It doesnt seem likely that a hacker would gain acces to your computer just to run a buggy program that "may" or "may not" give them more access to your computer. It seems to me that all the mac bug's are hard to exploit as apposed to something like blaster and it's variants. Written on Windows XP BTW. Patched and fealing safe. Hardware router u know people :)

    1. Re:sarcasm by Anonymous Coward · · Score: 0

      You lost me at "malitious".

      Next time title your message as "sarkhasm" and I'll know not to bother to try reading it at all.

  16. Fix ? by Jesrad · · Score: 1

    While some people waste their time ranting about Max's comment on the quality of some non-BSD parts of OS X, about whether this is a serious exploit (hint: it is) or whether it is newsworthy (it is, too), does anybody has a fix to propose besides removing the setuid bit (which, according to my quick and totally inconclusive test, serves no purpose) ?

    --
    Maybe we deserve this world ?
    1. Re:Fix ? by Fulkkari · · Score: 1
      does anybody has a fix to propose besides removing the setuid bit (which, according to my quick and totally inconclusive test, serves no purpose) ?

      I'm not familiar with the code, but mounting filesystems does require root access, doesn't it? So that is propably why it's set-uid. Anyway there is still quite many set-uid programs in OS X, and it would be nice to see that number somehow reduced.

      --
      I demand the Cone of Silence!
    2. Re:Fix ? by Jesrad · · Score: 1

      Any user can run cd9660.util and that's probably why it is setuid.

      --
      Maybe we deserve this world ?
  17. local vs remote holes, overall quality by 47PHA60 · · Score: 4, Insightful

    Even OpenBSD has local root exploits, and they have been fixing them for years. A local exploit could be used to load a root program that listens on the network, so you fix it.

    I've seen lots of security advisories make fun of or insult the product and company in question. Big deal, a programmer skilled enough to find a buffer overflow makes fun of Steve Jobs' product. Mr. Jobs can afford a gold thread hanky to wipe his tears, but more likely it just rolls off their backs; people have been making fun of Apple for decades.

    In general, it is hard to program an OS, and once it is out there, easier to poke holes in it. That is why security is difficult. Fix the problem, review your code for similar problems, fix those, move on.

  18. front page? by redJag · · Score: 0, Flamebait

    Why didn't this make the front page? It would have if it were a MS exploit. This is most likely a viable exploit, although you need a user account or physical access to the computer.

  19. Details: by Jesrad · · Score: 5, Informative

    The error lies in the cd9660.util_main.m file from the isoutil package, specifically, right in the start of the main function:

    if ( (myError = DoVerifyArgs( argc, argv, &mnt_flag )) != 0 )
    goto AllDone;

    /* Build our device name (full path), should end up with something like: */
    /* /dev/disk1s2 */
    strcpy( &myDeviceName[0], DEVICE_PREFIX );
    strcat( &myDeviceName[0], argv[2] );

    The strcat function fails with the huge devicename. DoVerifyArgs should check the length of argv[2] to be under 255 characters, but it only checks if it is longer than 2 characters:

    /* Make sure device (argv[2]) is something reasonable */
    myDeviceLength = strlen( argv[2] );
    if ( myDeviceLength < 2 )
    {
    goto ExitThisRoutine;
    }

    I'll make a quick fix and test it.

    --
    Maybe we deserve this world ?
    1. Re:Details: by Arkham · · Score: 4, Insightful

      And THIS parent post, ladies and gentleman, is EXACTLY why open source is good, and why Apple was VERY SMART to release its Darwin source code under an open-source license.

      Windows has a root exploit, and we are dependent on Microsoft to get around to fixing it. Thanks to Darwin, we can fix our own OSX bugs much of the time.

      --
      - Vincit qui patitur.
    2. Re:Details: by nickovs · · Score: 4, Interesting

      I have to say thank-you for finding that, although of course now you've wasted the afternoon I just spent building a shellcode to exploit the bug :-) (With a 520 byte argument the return address is at 479 bytes through the argument!)

      A couple of things are worth noting about this bug. Firstly, it appears that the utiliy gets run by some other setuid process so the program didn't need to be setuid in the first place (looking at the files /System/Library/Filesystems/*/*.util this is the only one that is setuid). This is fortunate because of the seond observation, which is that a cursory inspection reveals that other of these programs are also vulnerable (ufs.util needs a rather longer string but gives a segmentation fault with ufs.fs/ufs.util -p `perl -e "print 'A'x6750;"`).

      It might be useful if someone were to trawl through the other related utilities to see if there are any more unchecked string copies. I didn't find he source to all these utilities but the msdos_util seems to have some unchecked sprintf() calls. While these are probably not security critical because hopefully the root process that calls them can't be fooled into passing bad arguments it's still indicative of a lack of care in programming.

      --
      If intelligent life is too complex to evolve on its own, who designed God?
    3. Re:Details: by Jesrad · · Score: 1

      Thank you for the info. I'll work on correcting that more thoroughly now.

      --
      Maybe we deserve this world ?
    4. Re:Details: by Morth · · Score: 1

      Wow, I never thought I'd see code like strcat(..., argv[...]); except in testing code. Very bad of whoever made this.

    5. Re:Details: by Jesrad · · Score: 1

      I corrected this one, too. Get the fix at this place and move the corrected binary in the right place (/System/Library/Filesystems/ufs.fs/). I included the source code obviously, but you'll need the full diskdev package (plus dependant packages) from the Apple developer.apple.com website, to build it.

      --
      Maybe we deserve this world ?
  20. DONE by Jesrad · · Score: 4, Informative

    Get the fix with source code here, just double-click the install.sh script, it will make, copy and setuid the file at the correct location. Somebody please test and review this !

    --
    Maybe we deserve this world ?
    1. Re:DONE by gemello · · Score: 1

      The change looks good. The only file changed is cd9660.util_main.m, and only in appropriate ways. b alls/apsl/isoutil-28.tar.gz> was his start (accessing this file requires setting up an account with Apple.

    2. Re:DONE by Anonymous Coward · · Score: 0

      Why is this an Objective-C source file? I assume that this source originally contained ObjC code, but not any more. Was someone too lazy to change the .m to .c?

    3. Re:DONE by paimin · · Score: 1

      This works on 10.3, but I couldn't compile the code on a 10.1 machine, presumably because the code is from a newer and incompatible version of Darwin. It would be very useful to have a 10.1 compatible version of this fix, because it is highly unlikely that Apple will release a patch for anything earlier than 10.2.x. Thanks though!

      --
      Facebook is the new AOL
  21. Exploitable! by Tom7 · · Score: 1

    Right on. This is a classic overflow, and there is nothing magic about OS X that will make it hard to exploit.

    1. Re:Exploitable! by Paradox · · Score: 4, Informative

      Well, Mac machines ARE slightly harder since their instructions are aligned. You need to hit the alignment and the offset.

      Is is different from the x86 variable-length world. There are 3 possible alignments.

      In this scenario, it doesn't matter though, since it's a non-service.

      --
      Slashdot. It's Not For Common Sense
  22. Installation on OSX requires password by acomj · · Score: 1

    While I agree as OSX becomes more popular it becomes a bigger target, the enter password dialog that acompanies each installation makes people think a little before installing things.

    It doesn't solve it completely but helps.

  23. Why does it matter? by ITR81 · · Score: 2, Informative

    Apple will just post a fix for it in Jan. if they've been already told about it. They have new OS update coming this week so it could include a fix for this issue as well if it's an easy fix.

    1. Re:Why does it matter? by Jesrad · · Score: 3, Informative

      And Macbidouille has a fix NOW. Gotta love OpenSource ;)

      --
      Maybe we deserve this world ?
    2. Re:Why does it matter? by ITR81 · · Score: 1

      That is why I believe OS X is better then Windows simply because more folks can help fix it. Now all Apple will do is take the code for the fix and tweak it abit and add an installer and call it a Offical Security Update. This sucker will probably be out before end of Dec. Right now they are working on getting 10.3.2 ready for the public since it's going through it's final seeding to developers which just happened over last Fri. I expect a release for it this week unless some bugs got discovered in this final seeding.

  24. Details of the fix by Jesrad · · Score: 4, Informative

    The change is in the DoVerifyArgs function, from:

    myDeviceLength = strlen( argv[2] );
    if ( myDeviceLength < 2 )
    {
    goto ExitThisRoutine;
    }

    to:

    myDeviceLength = strlen( argv[2] );
    // Added check for lengths of myDeviceName over 255 chars; 16/12/2003 Namu
    if (( myDeviceLength < 2 ) || (myDeviceLength > 255))
    {
    goto ExitThisRoutine;
    }

    The tar.gz archive is just the same as the one from OpenDarwin, except for the fix in the code and the install.sh shell script that makes the utility, installs it under sudo, setuid's it and then cleans.

    --
    Maybe we deserve this world ?
    1. Re:Details of the fix by nacturation · · Score: 1
      if (( myDeviceLength 255))


      Wouldn't it be better to use sizeof() for the maximum length comparison rather than hardcoding the number?
      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    2. Re:Details of the fix by Anonymous Coward · · Score: 0

      crap... buggered up the HTML, but I'm sure you know what I mean. (note to self: preview is good, preview is good...)

    3. Re:Details of the fix by Jesrad · · Score: 1

      The 255 char limit of myDeviceName and myRawDeviceName strings is hardcoded anyway, but I agree this is not very elegant.

      --
      Maybe we deserve this world ?
    4. Re:Details of the fix by rezac · · Score: 1

      I have no idea what was posted above, but I enjoy reading the banter, especially on the odd chance that I may actually learn something. I am a longtime Mac user but have no illusions that OS X is "invulnerable." I do like the way my macs run, they do everything I need them to do, and even though I take precautions, I am pleased that they are somewhat more secure than boxes running a Windows OS. I think it is cool that within hours of posting a vulnerability, that there are people in the open source community with the skills to post a potential fix. Guess, I'll have to wait for Apple to post a security fix, though for it to be usable for me. Anyway thanks for letting me intrude in this highly technical/informative thread.

      --
      -- my sig got /.'d
  25. Does this work on a G5? by Paradox · · Score: 2, Interesting

    I had heard some suggestions that G5s didn't allow NOPs to overwrite their null bytes with random data. It seemed that the motorolla behavior for this was a bug to begin with, since those flags are reserved for future meaning, and as such the instruction is different if they are set.

    Does anyone know if these eggs fly on a G5? Here is a perfect chance to test! :)

    --
    Slashdot. It's Not For Common Sense
  26. How is this a serious exploit? by porkchop_d_clown · · Score: 1

    Seriously, I'm not sure how causing a segv in cdrom driver creates a security hole.

    Care to elaborate?

    --
    Clear, Dark Skies
  27. Someone needs a meta-mod spanking... by Anonymous Coward · · Score: 1, Insightful

    "Flamebait?" It's the honest truth, and I speak from the experience of a Mac user. Mac users are still accustomed to software that requires an installer instead of simply rejecting anything that doesn't come as a single bundle that you drop into the Applications folder. Every installer I've ever seen pretty much requires you to give it admin privileges to run.

    So, spyware for the Mac is inevitible if it ever gets enough marketshare for everyone to care. It's inevitable even if we just have to wait for some marketer to think we're a worthwhile niche market.

    He's right. The ultimate hacks are always social hacks. Getting idiots to install malware on their own systems is much, much easier than writing exploit code.

    1. Re:Someone needs a meta-mod spanking... by eyeball · · Score: 1

      Thank you AC :)

      --

      _______
      2B1ASK1
    2. Re:Someone needs a meta-mod spanking... by Anonymous Coward · · Score: 0

      All moderation in apple.slashdot.org has been outsourced to India. It started a few weeks ago.

  28. Can you test it on a G5? by Paradox · · Score: 2, Interesting

    Hey,

    I do not have a G5, nor do I know anyone with a G5. So I cannot test this, but I've heard some of my security-friends (like the super friends, only ugly, fat, and obnoxious instead of ugly, healthy and obnoxious) that the G5's don't allow the NOP's with non-0 flags.

    This is probably the proper behavior. I'm convinced that Motorolla's acceptance of these facts was a bug, not a feature.

    Could you test it and find out? I'm really curious.

    --
    Slashdot. It's Not For Common Sense
    1. Re:Can you test it on a G5? by Anonymous Coward · · Score: 0

      It's really not relevant if a G5 will execute a NOP with non-zero data in the middle.
      One can simply use instructions that do nothing in lieu of a NOP.

      For example: xor r7, r7, r7

    2. Re:Can you test it on a G5? by Paradox · · Score: 1
      True. I should have been more clear (I was having a rough day). What I should be referring to is the tendancy of the G4 to allow certain instructions (including NOPS and the syscall instruction) reserved bytes to be something other than 0.

      I should at this point reference "Smashing the Mac for Fun & Profit".

      From a chip designer's standpoint, it probably made the logic easier.

      From a correctness standpoint, these flags may eventually have meaning. The correct implementation would be to claim the instruction was illegal.

      Now, if SC couldn't be called when you upload shellcode, then a lot of remote exploits would be noticably more difficult. You can of course return back into libc or some other library function.

      This is more difficult, requires more tuning, and can't always be done eaisly. In other words, it makes it less automatable, which reduces the number of script kids who can get their dirty, clueless paws on something.

      Thus, I will ask again in a more clear fashion. Is the G5 accepting these tweaked instructions or is it rejecting them?

      If it is rejecting them, buffer overflows on a mac will be that much harder. This doesn't mean they're utterly immune to them. It means that they're a much less attractive target.

      --
      Slashdot. It's Not For Common Sense
  29. Please explain by Anonymous Coward · · Score: 0

    Could you please explain a bit what "NUL-less" code is and how one gets it executed and how one computes offset for the return stack?

    1. Re:Please explain by Anonymous Coward · · Score: 0

      NUL-less code is code which doesn't have any NULL values in it. Back to grade 1 reading comprehension for you, script kiddy!

    2. Re:Please explain by You're+All+Wrong · · Score: 5, Informative

      NUL is '\0' the byte valued 0.

      C uses '\0' to delimit strings. Therefore a strcat will not go past the first '\0' in the shellcode (or whatever exploit it is you're trying to run).

      So, if the code you want to run needs '\0's in it it must build those values on the fly. (e.g. subtract any value from itself and you instantly have a register loaded with 4 zeroes.) If you need opcodes that have 0 somewhere in them, then you need to self-modify, or you need to find a way to write what you want without using such opcodes. Most people go for the former.

      That's all there is to being NUL-less. It's easy on x86, but slightly more challenging on fixed-length opcode machines (RISCs and VLIWs). Similarly, avoiding just '\0' is pretty easy - the real skill is from avoiding anything but [a-zA-Z0-9] such that you can pass some input sanitisers. (See posts by Herbert Kleebauer on alt.lang.asm for examples of ascii-only executables (one was called 'beth.com' IIRC, google should find it).)

      To calculate the jump, just work out which of the 512 'A's are the 4 that you can see in the debugger stack trace. It's easiest to work this out by not having every character in the overflowing string being the same character. That's why I suggest 'abcdef...'
      If you now see the backtrace as containing 0x66676869 then you know it was one of your 'fghi's that you're now looking at. However you don't know which one yet, so try again with a different repeated string with a different length, and 'triangulate'. Or simply use a single probe with a string that doesn't repeat, such as "aaabacad....azbabbbcbd....bzcacbcccd..."
      Anyway, that tells you where in the string you need to put the address that you want to jump to. The next problem is working out what that address should be. This you can get from the debugger.

      Read Aleph One's "smashing the stack for fun and profit" for more info. Once you can do it on one architecture, you'll be equipped to do it pretty much on all of them.

      Have fun, but remember to practice safe hex.
      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
    3. Re:Please explain by O · · Score: 1

      These results contain a link to the beth.com file, but I can't download it because someone decided to be political and block US netblocks from his website. Oh well.

      Smashing the Stack for Fun and Profit.

      --

      1, 1, 2, 3, 5, 8, 13, 21 -- Mathematics is the Language of Nature.
    4. Re:Please explain by You're+All+Wrong · · Score: 1

      Beth is often having com files dedicated to her, so there's most likely more than one beth.com. However, the ASCII .com files guru is Herbert, so at least that part of the search was correct and unambiguous, and the first hit you list is the one I remembered.
      (Although I remember the third one, the blocked link one, too now, it made me feel quite sick after staring at the screen for a couple of minutes!)

      And seeing that Herbert post again after I realised what would be a better search term: "@echo off" as all of his batch files begin with that line. Here are some more:

      Here's an ASCII program that he uses to ASCII-fy other programs (complete with source too, so you can ASCII-fy your own arbitrary code!)
      http://groups.google.com/groups?hl=en&lr=& ie=UTF-8 &oe=utf-8&selm=3CFFE133.9870ABAD%40unibwm. de

      Here's a useful text search/replace program:
      http://groups.google.com/groups?hl=en&lr =&ie=UTF-8 &oe=utf-8&selm=3D16DD47.E7B409CD%40unibwm. de

      Here he's being a little naughty, by the looks of things:
      http://groups.google.com/groups?hl=en&lr= &ie=UTF-8 &oe=utf-8&selm=3E12B526.B0442AF2%40unibwm.de&prev= /groups%3Fhl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3Dutf- 8%26q%3D%2522%2540echo%2Boff%2522%2Bgroup%253Aalt. lang.asm%26btnG%3DGoogle%2BSearch

      No idea what these are:
      http://groups.google.com/groups?hl=en&lr=&ie =UTF-8 &oe=utf-8&selm=3E26D3B9.418F602%40unibwm.de&prev=/ groups%3Fhl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3Dutf-8 %26q%3D%2522%2540echo%2Boff%2522%2Bgroup%253Aalt.l ang.asm%26btnG%3DGoogle%2BSearch
      http://groups.go ogle.com/groups?hl=en&lr=&ie=UTF-8 &oe=utf-8&selm=3F56D877.21190F72%40unibwm. de

      However, you get the idea - once you can create a small decoder just in ASCII bytes, then you can create more complicated programs on the fly. From what Herbert said in one of those posts, Laura Fairhead also has such an ASCII-fying engine. The famous Terje Mathison also has one, which he was telling us about only very recently (either alt.lang.asm or comp.lang.asm.x86).

      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
  30. WOW! Open source rocks! by Anonymous Coward · · Score: 0

    this is sort of breath taking that it could be fixed like that fast.

  31. Further flaws in cd9660.util by Fulkkari · · Score: 1

    It seems that the cd9660.util allows you to mount your CD to any location. This means that an attacker could insert a malicious CD into the drive, umount /Volumes/CD and remount the CD eg. at /var/cron/tabs allowing the attacker to "change" system critical files or fake any directory in the filesystem. This will result in system compromise.

    This cd9660.util does look a bit suspicious, and I recommend that on computers where local compromise is an issue, you could think of removing the set-uid bit until a fix is issued by Apple. This propably will cause some errors when inserting CDs. I'm investigating this further...

    PS. As the cd9660.util calls mount_cd9660 it isn't possible to mount files, so unless there is physical local access to the machine, it shouldn't be very easy to exploit.

    --
    I demand the Cone of Silence!
  32. There's a buffer overflow even in the fix... by kirby81_it · · Score: 2, Informative

    argv[2] gets strcat-ted with DEVICE_PREFIX:

    DEVICE_PREFIX = "/dev/"
    strcpy( &myDeviceName[0], DEVICE_PREFIX );
    strcat( &myDeviceName[0], argv[2] );

    and myDeviceName is declared as a 0..255 array.

    So the right check should be:

    myDeviceLength > 250

    Even worse, there's the following code after the strcpy-strcat couple:

    strcpy( &myRawDeviceName[0], RAW_DEVICE_PREFIX );
    strcat( &myRawDeviceName[0], argv[2] );

    and
    RAW_DEVICE_PREFIX = "/dev/r"

    myDeviceLenght should not be more than 249 character long.

    So the right code should be:

    myDeviceLength = strlen( argv[2] );
    // Added check for lengths of myDeviceName over 255 chars; 16/12/2003 Namu
    if (( myDeviceLength < 2 ) || (myDeviceLength > 249))
    {
    goto ExitThisRoutine;
    }

    1. Re:There's a buffer overflow even in the fix... by Jesrad · · Score: 1

      It is the strcat function that segfaults if handed a string over 255 chars, not the rest of the code. I agree that there should be more exact checks but as it is now the exploit is corrected. I'll change that now.

      In fact the code should use strncpy and not use strcat in the first place...

      --
      Maybe we deserve this world ?
    2. Re:There's a buffer overflow even in the fix... by dzerkel · · Score: 2, Insightful

      Actually, using strlcpy() and strlcat() in place of most strcpy() and strcat()s would go a long way to preventing buffer overflows from happening.

      Now, strlcpy() and strlcat() are relatively new, and may not have been available when this was written, but they are certainly available in Darwin now.

      Danny

      --
      "What's the point of going abroad, if you're just another tourist..."
    3. Re:There's a buffer overflow even in the fix... by Bimble · · Score: 4, Funny

      This is the first time I've seen Slashdot put to a practical use. Doesn't that violate the terms of service?

      --
      Naked.
  33. Re: timely patches? by Anonymous Coward · · Score: 0

    Do you see a patch for that root-granting DHCP issue? Neither do I.

    2+ months after notification isn't very timely.

  34. Oh God No. by /dev/trash · · Score: 1

    That's all we need here, is an increase in Ask Slashdots. "Dead Slashdot, I need to plug in Christmas lights but the plug won't reach and I don't want to use a wireless device nor would I like to use an extension cord. Help me please."

  35. Found another flaw by Anonymous Coward · · Score: 4, Funny

    I found ANOTHER security flaw in OS X. It turns out that if I leave my password laying around, someone might actually pick it up and log on under my user name when I'm not around! The security folks at Apple are not doing their job.

    1. Re:Found another flaw by Jesrad · · Score: 1

      "User error: please change user."

      This one has been known for a loooong time, under both "ID10T" and "PEBCAK" names.

      --
      Maybe we deserve this world ?
    2. Re:Found another flaw by burns210 · · Score: 1

      ironicly, for a long while Windows took care of the need of making you WRITE DOWN your password and leave it in plain site: they let you hit CANCEL and the system would login for you!

  36. Minor correction by HTH+NE1 · · Score: 1
    These are programs which people use every day to get work done. They are available on Mac OS X. They are not available on Linux.

    Shake was on your list of programs, but is available on Linux. It just isn't free:
    Buy Shake 3

    For Mac OS X
    $4,950.00

    Buy Now

    Shake 3 is also available for Linux for a suggested retail price of $9,900 (US) with an annual maintenance of $1485 (US). Render-only versions of Shake 3 are free on Mac OS X and are available for Linux for a suggested retail price of $3,900 (US) with an annual maintenance of $585 (US). Contact an Apple Authorized Professional Film Reseller to purchase.
    Just a minor correction.
    --
    Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
  37. buffer overflow != exploit by aminorex · · Score: 2, Insightful

    A buffer overflow is a bug. While all
    exploitable defects allowing unauthorized
    priviledge escalation are bugs, not all bugs
    are defects which can be exploited to effect
    unauthorized priviledge escalation.

    --
    -I like my women like I like my tea: green-
  38. Re: timely patches? by Jesrad · · Score: 3, Interesting

    ...because there is no need for a patch. Just open Directory Access and uncheck a box. If you insist for running a patch you might be able to make the process into an AppleScript.

    Happy ?

    --
    Maybe we deserve this world ?
  39. OMG BOOBIES!!!!1111!!!one!!!1oneone11! by Anonymous Coward · · Score: 0

    Boobies!

    Gotta love 'em!

  40. on top? by shaitand · · Score: 1

    I like MacOS X, it's a great system. But how does somewhere about last in the small server market, 3rd in the desktop, and nonexistant in the embedded or high end server or mainframe put it on top?

    1. Re:on top? by all+your+mwbassguy+a · · Score: 2, Interesting

      3rd in the desktop? behind windows and what?

    2. Re:on top? by shaitand · · Score: 1

      linux, don't keep up with the market these days eh? Mac is number 3 on the desktop now. Despite linux on the desktop is dead sayers.

      I myself would certainly rather work with MacOS X than windows, but given complete choice I'll go with linux, which gives me power that isn't yet matured in the Mac GUI and lacks the proprietary ties.

  41. Ye gods by FredFnord · · Score: 1

    About 15 years ago, I ran into a problem with strcat stomping all over my variables, and I thought, 'hunh, why didn't I use strncat instead?' And so I used strncat, and have every single time for every program I've ever written since then. And, aside from one time when I accidentally made the array size 2 instead of size 20, I haven't had that particular problem again.

    I can imagine if someone were doing a major profiling job, and strcat were 10x faster than strncat and were inside the inner loop of the bottleneck, he might want to use strcat. But in that case, it implies enough attention to the actual code that he'd presumably know how to check for overflows beforehand.

    But aside from that, why in the world would anyone with half a brain use strcat when strncat is available? Really... I'm asking. Is there actually some reason?

    -fred

    --
    Sign #11 of Slashdot overdose: You see the phrase 'moderate Republican' and you wonder if that would be a +1 or a -1.
    1. Re:Ye gods by ZerothAngel · · Score: 1
      But aside from that, why in the world would anyone with half a brain use strcat when strncat is available? Really... I'm asking. Is there actually some reason?

      Or for that matter, strlcpy and strlcat? (On systems that have them. From what I know - *BSDs, OS X, and Solaris.)

  42. Search... by Anonymous Coward · · Score: 0

    Power search not working on iTunes music store. Its all falling apart...

  43. Twit by Anonymous Coward · · Score: 0

    Also, 'Max' made entirely unfounded, sweeping statements about the general quality of Mac OS X from this one little item, but oh well.

    MacDork, you really are a dork all right. The guy hardly says a word. What are you - a PFY? a wimp?

    Enough of this sniveling nonsense.

  44. not really by Scudsucker · · Score: 1

    The reason there are so many viruses and exploits for Windows is because Microsoft makes it so easy for them to spread. Typical Outlook email virus? You click on the email from your friend, click on the attachment that he sent you, and its automatically opened and executed, typically as an Administrator. The really bad ones, you wouldn't even have to open the attachment to activate it; just previewing the message is enough.

    Contrast that to Apple, where you click on the attachment, download it, then have to open the attachment, and then enter your password for it to run as root. Thats another two steps (a big one with asking the password) that a virus has to take before being executed. The more steps a worm or cracker has to go through to get into your system, the more the chance of a successful attempt will drop.

    Sure, there will always be social engineering, but Microsoft makes it so easy while Apple actually makes you work for it.

  45. Re: timely patches? by cbreaker · · Score: 1

    Eh, just because you can work around an exploit, that you can cover it up and disable it, doesn't mean it shouldn't be fixed. I think it's kinda weak to think that this is okay, no offence..

    --
    - It's not the Macs I hate. It's Digg users. -