Apple's Mac OS X operating system may allow local privilege escalation in family of "at" commands.
Mac OS X includes the "at" family of commands in order to schedule tasks. However, a flaw in these commands results in the commands not dropping privileges correctly. This may allow a malicious local user to run commands with additional privileges, read or remove protected files, or gain other unintended access.
The affected commands include:
These commands are disabled by default in Mac OS X. If they have been enabled, a malicious local user may gain additional privileges including the ability to remove or read protected files, or run programs with additional privileges.
Apply a patch
Apple advises all users to apply Apple Security Update 2005-001, as it fixes this flaw and other critical security flaws.
Vendor| Status| Date Notified| Date Updated
Apple Computer Inc.| | -| 27 Jan 2005
If you are a vendor and your product is affected, let us know.
Group | Score | Vector
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A
Thanks to Apple Product Security for reporting this vulnerability. Apple in turn thanks Kevin Finisterre of Immunity, Inc. for reporting this vulnerability.
This document was written by Ken MacInnis.