Description
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file.
References
- 20060302 Apple Mac OS X passwd Arbitrary Binary File Creation/Modification third-party-advisory
- 20060302 [OSX]: /usr/bin/passwd local root exploit. mailing-list
- 19064 third-party-advisory
- 23647 vdb-entry
- 16907 vdb-entry
- ADV-2006-0791 vdb-entry
- 16910 vdb-entry
- APPLE-SA-2006-03-01 vendor-advisory
- TA06-062A third-party-advisory
- http://docs.info.apple.com/article.html?artnum=303382
- macosx-passwd-symlink(25274) vdb-entry