3 ms·
> The two bugs, Wardle said, can be launched by a local attacker — that’s where someone has physical control of a vulnerable computer.
by dewey 7y ago
> The two bugs, Wardle said, can be launched by a local attacker — that’s where someone has physical control of a vulnerable computer.
- monocasa 7y agoIt's still a root privilege escalation.
- sc3n3ry 7y agoLPE has always been trivial on OS X... for the longest time, the passwordless-sudo timeout was not specific to the tty. So all you had to do was wait for someone to use sudo, and you would be able to get root.
- monocasa 7y agoCool. Companies that go "I should use a LPE as part of my product" should still be chastised.
- oefrha 7y agoUnless I misunderstood, the escalation prompt only appears if you’re a non-admin user performing the install, and you still need to possess and enter admin credentials in the prompt to do anything at all. Outside of paranoid nerds who refuse to use an admin account day-to-day (I’ve only heard about this kind of people online, yet to meet one in meat space), who uses their Mac like that? (Genuine question.)
- kart23 7y agoI've seen schools do this. My old high school had macbook airs available for checkout at the library, as well as the desktops used for printing. Obviously the student user did not have admin access, and a student could trivially gain it using this method, opening up the systems to all sorts of nasty stuff.
- oefrha 7y agoThe key here is the user needs to possess admin credentials; the prompt itself is just a prompt, think sudo/su. I fail to see why random students would have admin credentials.
- kart23 7y agoOh, ok I didn't read the original article thoroughly. The user still needs to give it the admin password, but the installer can be modified to also execute arbitrary code as the root user.