Mac OS X - malloc() local privilege escalation vulnerability.

Suresec Security Advisory - #00007

25/09/2005

Mac OS X - malloc() insecure use of environment variable.
Advisory: http://www.suresec.org/advisories/adv7.pdf

Description:

The malloc() function on Mac OS X insecurely trusts a debug variable,
regardless of the fact that the calling application may be suid root.

This can result in an arbitrary file being overwritten, which can be
used to escalate privileges.

This vulnerability was discovered by Ilja van Sprundel.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Sep 25 2005