This exploit allows an attacker to create a directory called "xfinder" in the user's home directory. Once the root user modifies the directory using Finder, the exploit will write to the .DS_Store file in that directory. The data written to the .DS_Store file will consist of the filenames/subdirectories and attributes of the directory. The exploit works by linking the .DS_Store file to /etc/crontab and creating a special unicode(utf8 encoded) file in the directory. The file created in unicode contains a line that will overwrite /etc/sudoers with "ALL ALL=(ALL) ALL" when written to /etc/crontab. This allows the attacker to escalate privileges and sudo to root.