Info

Last Modified

7 months ago

Percent Complete

65%

Disclosure

Jun 16, 2003

Discovery

Jun 09, 2003

Dates

Exploit

Unknown

Solution

Unknown

Description

The installion procedure for the Dantz Retrospect Client creates a new StartupItems subdirectory with world-writable permissions. A malicious local user could modify this script to perform any action they want with the privileges of the operating system.

Classification

Unknown or Incomplete

Technical

After the initial installation, the directory /Library/StartupItems/RetroClient is created with mode 777, owned by the user who installed the software. This directory contains the RetroClient startup script that is executed every time the system is booted. The startup script is created with the same permissions and ownership as its parent directory. A malicious local user could modify this script to perform any action they want with the privileges of the operating system.

Solution

Dantz software has not published a solution to this problem. An unofficial solution involves changing the permissions of the files manually. The /Library/StartupItems and /Library/StartupItems/RetroClient directories should be mode 775, the files in /Library/StartupItems/RetroClient should be mode 755.