Re: Buffer overflow/privilege escalation in MacOS X - hfs.util also

[KF <dotslash () snosoft com>]

The funny thing is that I have reported this to apple more than once if 
I remember correctly... first in 10.1 and recently in 10.3,  I have yet 
to hear back on the issue. As a side note apple has a no talky / no 
verify policy until the bug is fixed... they just keep you pretty much 
100% in the dark. Dave G finally talked some sense into me and I stopped 
trying to exploit the hole. I have spent many hours banging my head 
trying to figure out why things will not work out. I had been holding 
out for a response from apple but since this is now public info I'll 
probably jot down some public notes on what a pain it is. If any one is 
interested the code causing this issue it is located below.

*In earlier versions of OSX there is also hfs.util and it contains the 
same issue. hfs.util is no longer setuid in OSX 10.3*

http://web.mit.edu/afs/sipb.mit.edu/project/darwin/src/modules/isoutil/cd9660.util_main.m

...
char myRawDeviceName[256];
char myDeviceName[256];
...
/* Build our device name (full path), should end up with something like: */
/* /dev/disk1s2 */
strcpy( &myDeviceName[0], DEVICE_PREFIX );
strcat( &myDeviceName[0], argv[2] );
strcpy( &myRawDeviceName[0], RAW_DEVICE_PREFIX );
strcat( &myRawDeviceName[0], argv[2] );
...
/* call the appropriate routine to handle the given action argument 
after becoming root */
myActionPtr = &argv[1][1];
myError = seteuid( 0 );
switch( *myActionPtr ) {
...
exit (myError);

------------------- and the vulnerability in hfs.util that was not 
reported --------------------

http://www.mit.edu/afs/sipb/project/darwin/src/modules/hfs/hfs_util/hfsutil_main.c
...
char rawDeviceName[MAXPATHLEN];
char blockDeviceName[MAXPATHLEN];
/* -- Build our device name (full path), should end up with something 
like: -- "/dev/disk0s2" */
sprintf(rawDeviceName, "/dev/r%s", argv[2]);
sprintf(blockDeviceName, "/dev/%s", argv[2]);
...
exit(result);
-KF