if I'm reading this right, it looks like a non-logged in workstation could be vulnerable to a local root use if an admin is running an remote install. so the "attacker" would have to know that a remote operation is going on and the "attacker" would need physical access. or I may just be reading this wrong.
~mike~ Yannick von Arx wrote: > It seems so that the attacker needs a ARD enabled user plus vnc > password to access the client. > Then he can send an install command over "Manage > Send UNIX Command" > > We're talking about ARD 3.0 so we've got the new feature to lock > client's screen with a message. > From my point of view it's not a vulnerability in ARD, just an > insecure point. > > Regards, > Yannick von Arx > > On 19.09.2006, at 19:32, Erik Lat wrote: > >> >> So in order for this vulnerability to be exploited, the attacker needs >> to have a local account on the machine correct? Your exploitation >> explanation >> is a bit construed. Any more info / demostrations would be helpful. >> >> -Erik >> >> On 18 Sep 2006 21:26:52 -0000 >> [EMAIL PROTECTED] wrote: >> >>> Background: >>> ARD allows unix commands to be remotely sent from an admin >>> workstation. These commands can be run as root, because the ard >>> administrator can be given sudo access. This exploit involves >>> sending a unix command as root to install a package that was copied >>> to /tmp/. In this case, the app is Adobe CS 2.0 using the adobe >>> silent installation script. The script will mount disk images as >>> root, run the install, then cleanup. If a standard user is logged >>> in, they will see an icon on the dock for the install, but should >>> never see anything besides the icon. >>> >>> The issue: >>> The process LoginWindow is owned by the logged in user. If the >>> system is at the login window, then the process LoginWindow is >>> owned by root. If the system is mounting a disk image visible only >>> to root, then the image will try to appear on the desktop. Clicking >>> the mouse will force the desktop to appear, as well as the menus. A >>> user sitting that the system will then see a finder window, and the >>> root users home directory. The login window can be ignored, and the >>> user has full root access. Files can be deleted without >>> authentication, and the trash can be emptied. If a user tries to >>> login, the login window will check their credentials, but they will >>> end up logging in to the root desktop with root privileges. >>> >>> The workaround: >>> If you are trying to run a remote install script such as the Adobe >>> Silent installer, use the lock screen feature in ARD. This locks >>> the users desktop until the admin is done doing their thing. >>> >>> The end result: >>> http://www.flickr.com/photos/metfoo/246858852/ >>> >>> Adobes script: >>> #!/bin/sh >>> # >>> # Example script to run the Adobe Creative Suite 2 Installer silently. >>> # >>> # >>> # Copyright: 2005 Adobe Systems, Inc. >>> # >>> # >>> >>> >>> function detach_images >>> { >>> # umount any previous mounted installer images >>> for NUMBER in 1 2 3 4 >>> do >>> MOUNTED_POINT="/Volumes/Adobe Creative Suite Disk ${NUMBER} " >>> /sbin/mount |/usr/bin/grep "${MOUNTED_POINT}" 2>/dev/null >>> if [ $? -eq 0 ] ; then >>> echo "Another \"${MOUNT_POINT}\" already attached." >>> DEVICE=`/sbin/mount |/usr/bin/grep "${MOUNTED_POINT}" >>> 2>/dev/ null |/usr/bin/cut -d" " -f1` >>> if [ -b "${DEVICE}" ] ; then >>> /usr/bin/hdiutil detach "${DEVICE}" >>> echo "Detaching \"${DEVICE}\"..." >>> fi >>> fi >>> done >>> } >>> >>> >>> SAVEDIR="`pwd`" >>> trap 'cd "${SAVEDIR}"' EXIT >>> >>> >>> if [ $# -ne 2 ] ; then >>> echo "usage: $0 <image folder> <config filepath>" >>> exit 1 >>> fi >>> >>> IMGDIR=$1 >>> CONFIG=$2 >>> >>> >>> # Check OS Version, Minimum is 10.2.8 >>> OSVERSION=`/usr/bin/sw_vers |/usr/bin/grep ProductVersion |/usr/ >>> bin/cut -d: -f2` >>> MAJORVER=`echo ${OSVERSION} | /usr/bin/cut -d . -f2` >>> MVTEMP=`echo ${OSVERSION} | /usr/bin/cut -d. -f3` >>> MINORVER=${MVTEMP:-0} >>> >>> if [ ${MAJORVER} -lt 3 ] ; then >>> # if less then 10.3 >>> if [ ${MAJORVER} -ne 2 ] ; then >>> echo "This version of MacOS (${OSVERSION}) is not >>> supported." >>> exit 1; >>> else >>> if [ ${MINORVER} -lt 8 ] ; then >>> echo "This version of MacOS (${OSVERSION}) is not >>> supported." >>> exit 1; >>> fi >>> fi >>> HDIUTIL_OPTIONS= >>> else >>> # additional hdiutil options for 10.3 or above system >>> HDIUTIL_OPTIONS="-private -noverify" >>> fi >>> >>> >>> # Check root volume is HFS >>> /sbin/mount -t hfs |/usr/bin/grep " / " 2>/dev/null >>> if [ $? -ne 0 ] ; then >>> echo "Root volume is not a HFS volume." >>> exit 5 >>> fi >>> >>> # validate the arguments >>> if [ ! -d "$IMGDIR" ] ; then >>> echo "$IMGDIR" does not exist. >>> exit 2 >>> fi >>> >>> >>> if [ ! -r "$CONFIG" ] ; then >>> echo "$CONFIG" does not exist. >>> exit 3 >>> fi >>> >>> >>> # Check running as root >>> MYUID=`/usr/bin/id -u` >>> >>> if [ ${MYUID} -ne 0 ] ; then >>> echo "You need to be root to run the Adobe Creative Suite 2 >>> Installer." >>> exit 4 >>> fi >>> >>> >>> cd "${IMGDIR}" >>> IMGCOUNT=`/bin/ls -l *.dmg 2>/dev/null | /usr/bin/wc -l` >>> if [ -z "${IMGCOUNT}" -o "${IMGCOUNT}" = "0" ] ; then >>> echo "No disk image found in "${IMGDIR}"." >>> exit 2 >>> fi >>> >>> #detach any already attached installer images >>> detach_images >>> >>> # Mount the disk images for the installer CDs >>> for DMG in *.dmg >>> do >>> # mount the remaining disk images >>> echo >>> echo "--- Attaching Installer disk image ${NUMBER}..." >>> echo /usr/bin/hdiutil attach -verbose -readonly $ >>> {HDIUTIL_OPTIONS} "${DMG}" >>> /usr/bin/hdiutil attach -verbose -readonly ${HDIUTIL_OPTIONS} "$ >>> {DMG}" >>> >>> if [ $? -ne 0 ] ; then >>> echo "Error in attaching installer disk image: \"${DMG}\"" >>> exit 6 >>> fi >>> done >>> >>> echo >>> echo >>> echo "---- Starting the Adobe Creative Suite Installer..." >>> echo >>> "/Volumes/Adobe Creative Suite Disk 1/Adobe Installer.app/Contents/ >>> MacOS/Adobe Installer" --batch -c "${CONFIG}" >>> INSTALLATION_RESULT=$? >>> echo >>> >>> #now detach attached installer images >>> detach_images >>> >>> exit ${INSTALLATION_RESULT} >>> >> >> >> -- >> >> Erik Lat >> System Engineer >> Lextech Global Services >> > > -- > e-mail: [EMAIL PROTECTED] > web: http://www.yanux.ch > > > > -- Mike Kuriger Sr. Systems Engineer WarnerBros Online 818-977-8198 [EMAIL PROTECTED] aim - mikekuriger
