Mac OS X - malloc() local privilege escalation vulnerability.

[[ Suresec Advisories ] <advisories () suresec org>]

Suresec Security Advisory - #00007

25/09/2005



Mac OS X - malloc() insecure use of environment variable.
Advisory: http://www.suresec.org/advisories/adv7.pdf

Description:

The malloc() function on Mac OS X insecurely trusts a debug variable,  
regardless of the fact that the calling application may be suid root.

This can result in an arbitrary file being overwritten, which can be  
used to escalate privileges.

This vulnerability was discovered by Ilja van Sprundel.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/