Description
HelpViewer in Mac OS X 10.3.3 and 10.2.8 processes scripts that it did not initiate, which can allow attackers to execute arbitrary code, an issue that was originally reported as a directory traversal vulnerability in the Safari web browser using the runscript parameter in a help: URI handler.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apple Mac OSX 10.3.x - Help Protocol Remote Code Execution EDB-24121 · remote · May 17, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VU#578798 third-party-advisory
- 11622 third-party-advisory
- APPLE-SA-2004-05-21 vendor-advisory
- 10356 vdb-entry
- 6184 vdb-entry
- 20040516 Vuln. MacOSX/Safari: Remote help-call, execute scripts mailing-list
- http://www.fundisom.com/owned/warning
- macos-runscript-code-execution(16166) vdb-entry
- 1010167 vdb-entry