Description
The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program, which allows local users to execute arbitrary code by creating the port before launching the setuid program, then writing to the address space of the setuid process.
References
- macosx-mach-privilege-escalation(38466) vdb-entry
- 26444 vdb-entry
- 20071114 Apple Mac OS X Mach Port Inheritance Privilege Escalation Vulnerability third-party-advisory
- APPLE-SA-2007-11-14 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307041
- ADV-2007-3868 vdb-entry
- 27643 third-party-advisory
- TA07-319A third-party-advisory