Secunia

Multiple vulnerabilities have been reported in Mac OS X, where the impact spans from local DoS (Denial of Service) vulnerabilities to privilege escalation, security bypasses and information disclosure.

1) A boundary error in the handling of argv[] arguments can be exploited by malicious, local users to crash the kernel by supplying an overly long command line argument. The vulnerability may possibly also be exploited to escalate privileges, though this hasn't been proven.

The vulnerability could potentially also be exploited remotely if an application spawns a new process based on user input.

Versions 10.2.8 and prior are affected.

2) Due to generally insecure file permissions and an error in handling DMG files, it is possible for malicious, local users to overwrite some executable files. This may be exploited to gain escalated privileges by tricking another user into running an overwritten file.

Versions 10.2.8 and prior are affected.

3) Malicious, local users can overwrite arbitrary files on a system or read core files dumped by privileged processes if core file creation is enabled (disabled by default). This can be exploited via symlink attacks to gain knowledge of sensitive information or corrupt files.

Versions 10.2.8 and prior are affected.

4) The slpd daemon creates temporary files insecurely in the "/tmp" folder when "Personal File Sharing" is enabled (disabled by default). This can be exploited by malicious, local users to overwrite arbitrary files on a system via symlink attacks.

5) An older vulnerability in ktrace can potentially be exploited by malicious, local users to gain knowledge of sensitive information by tracing a specially privileged process.

Successful exploitation requires that the KTRACE kernel option is enabled.

6) An older vulnerability in NFS (Network File System) can be exploited by a malicious user to cause a vulnerable system to lock up by sending specially crafted RPC messages with a zero length payload.

7) An older format string vulnerability in the gm4 utility can potentially be exploited by malicious, local users to escalate privileges.

Successful exploitation requires that a suid program relies on gm4. According to Apple, no privileged applications do this by default.

8) A vulnerability in OpenSSH can be exploited by users to access the system from IPs that they where not supposed to.

For more information:
SA8974

9) An older vulnerability in the nidump utility can be exploited by malicious, local users to read the encrypted passwords in the password file.

10) Due to an error after authenticating with an administrator password, malicious users can access "Preference Panes" that they normally can't access for a short period of time.

11) Since TCP timestamps are initialised with a constant number, malicious people can determine how long a system has been running based on the ID in TCP packets.

12) The Mail application will silently fall back to plain-text authentication when an account is configered to use MD5 Challenge Response but the hashed login fails.

13) It is possible to access Dock functions blindly behind Screen Effects when Full Keyboard Access is enabled.

Solution
Upgrade to Mac OS X 10.3 (Panther) or apply Security Update 2003-11-19.
Further details available in Customer Area

Provided and/or discovered by
Matt Miller and Dave G, @stake (issues #1-4)
Anthony Holder (issue #10)
Aaron Linville (issue #11)
Chris Adams (issue #12)

Changelog
Further details available in Customer Area

Original Advisory
@stake - Long argv[] Buffer Overflow:
http://www.atstake.com/research/advisories/2003/a102803-3.txt

@stake - Systemic Insecure File Permissions:
http://www.atstake.com/research/advisories/2003/a102803-2.txt

@stake - Arbitrary File Overwrite via Core Files:
http://www.atstake.com/research/advisories/2003/a102803-1.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area