|
Mac OS X Software Update Security Issue
(Security Advisory,
Exploit)
Author: Russell
|
Mac OS X Exploit - SoftwareUpdate - PhantomUpdate attack
Resolution
The issue described below was addressed and take resolved by Apple July
12th 2002 by adding checksums to downloads. Update to current version of
Mac OS X via the software updates or visit AppleCare Document
75304
Information:
Anonymous writes "I have
recently been forwarded a mail from a reliable
source which highlights a possible security issue with Software Update.
I have not tested it myself, but both the source of the mail and the
person who forwarded it are reliable and have always helped me to keep
up to date with a Unix workstation...
The mail read as follows:
--------------------------------------
MacOS X SoftwareUpdate Vulnerability.
--------------------------------------
Date: July 6, 2002
Version: MacOS 10.1.X and possibly 10.0.X
Problem: MacOS X SoftwareUpdate connects to the SoftwareUpdate Server
via
HTTP with no authentication, leaving it vulnerable to attack.
--------------------------------------
http://www.cunap.com/~hardingr/projects/osx/exploit.html
--------------------------------------
Summary:
Mac OS X includes a software updating mechanism "SoftwareUpdate".
Software
update, when configured by default, checks weekly for new updates from
Apple. HTTP is used with absolutely no authentication. Using well known
techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial
to
trick a user into installing a malicious program posing as an update
from
Apple.
Impact:
Apple frequently releases updates, which are all installed as root.
Exploiting this vulnerability can lead to root compromise on affected
systems. These are known to include Mac OS 10.1.X and possibly 10.0.X.
Solution/Patch/Workaround:
There is currently no patch available. Hopefully the release of this
information will convince apple they need, at the very least, some basic
authentication in SoftwareUpdate.
Exploit: http://www.cunap.com/~hardingr/projects/osx/exploit.html
An exploit for this vulnerability has been released to the public for
testing purposes. It is distributed as a Mac OS X package which includes
DNS and ARP spoofing software. Also, it includes the cgi scripts, and
apache configuration files required to impersonate the Apple
SoftwareUpdatesServer.
SecureMac's View
This has been a known issue for quite some time, we received many emails
notifing us of the method Apple uses for software updates. This is
something Apple needs to address to verify the software which is being
installed is from their server. Checksums would work fine for this
method. Keep your computer physically secure, disable remote access and
this will not be a issue for you.
.
Feedback Time:
|
