Apple patch overlooks Mac OS X 10.3
By
Tom Sanders
4 October 2006 10:06AM
Tags:
apple | patch | overlooks | mac | os | 10
Older version of OS left open to local privilege escalation.
Apple's OS X 10.3 continues to suffer from a security vulnerability which the vendor repaired on newer versions of the operating system last Friday, a posting on the milw0rm security exploit site has warned.
The flaw is identified as CVE-2006-4392. It affects the Mach exception ports which handle kernel errors in OS X.
A malicious user with access to a system could use the flaw to execute unauthorised code in privileged programs. This effectively provides attackers with root access, allowing them to install applications and change system settings.
Apple released a patch on Friday that repairs 15 vulnerabilities in OS X 10.4. But it fails to address the Mach vulnerability in OS X 10.3, according to the milw0rm posting.
The posting also provides code demonstrating how to exploit the vulnerability.
Because exploiting the flaw requires access to a system, it primarily concerns shared systems in schools and libraries, for instance, as well as users who provide guest accounts over the internet.
Apple had not responded to requests for comment at the time of going to press.
Copyright © 2008 vnunet.com