A vulnerability has been discovered in Mac OS X and Apple Remote Desktop, which can be exploited by malicious, local users to gain escalated privileges.

The problem is that "ARDAgent", which is owned by "root" and has the setuid bit set, can be invoked to execute shell commands via AppleScript (e.g. through "osascript"). This can be exploited to execute arbitrary commands with root privileges.

The vulnerability is confirmed on Mac OS X 10.4 and reported in version 10.5, and is also reported in Apple Remote Desktop prior to version 3.2.2.

Solution
Apply Security Update 2008-005 or update Apple Remote Desktop to version 3.2.2.
Further details available in Customer Area

Provided and/or discovered by
Reported in the Macshadows.com forums and via Slashdot.

Changelog
Further details available in Customer Area

Original Advisory
Apple:
http://support.apple.com/kb/HT2647
http://support.apple.com/kb/HT3145

http://www.macshadows.com/forums/index.php?showtopic=8640
http://it.slashdot.org/article.pl?sid=08/06/18/1919224

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area