4 ms·

The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admi

The user has to be an admin and have executed sudo previously for this to work. I hope that anybody who's smart enough to have access to this command (and admin membership) is equally qualified to parse scripts that may exploit this vulnerability...

hunkop 13y ago
Root can do anything. If that's a vulnerability than the entire system is a vulnerability.
Steuard 13y ago
Not at all a safe assumption. Most importantly, it's not that uncommon for even less experienced Mac users to copy and paste Terminal commands to solve one problem or another. A lot of those "Just type this!" solutions I've seen involve sudo somewhere. But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that you run without sudo? I know that I don't.
- mirkules 13y ago
  "A lot of those "Just type this!" solutions I've seen involve sudo somewhere." Not sure if you're alluding to this trick: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste This particular exploit could be rather nasty when used in conjunction with the above.
  - chc 13y ago
    Not even that. Lots of Mac help sites will include snippets of Bash code for the user to enter (say, something using rm to delete files the Finder is having trouble statting), and people will just enter those. You don't even need to do anything sneaky with the copy/paste process. Just offer some malicious code and expect the user to run it blindly since they wouldn't be coming to MacNoobHelp.com if they were capable of vetting for exploits.
- ams6110 13y ago
  Particularly installer scripts that are run by the trendy technique of curl -L http://www.example.com/some/cool/thing/install.sh | bash Particularly risky if the protocol is not https. Even worse when the right-hand command is "sudo bash"
traviscj 13y ago
A few points: - The default user created at setup of OSX is in the admin group. - Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!) - Do you habitually read every line of source code your computer would execute before you run that code?
- zackkitzmiller 13y ago
  Homebrew fails if you attempt to run it with sudo.
  - traviscj 13y ago
    See my comment above. I'm not referring to running 'sudo homebrew ...', I'm talking about the installation, which has to run sudo to change some permissions in HOMEBREW_PREFIX.
- wcchandler 13y ago
  I was unaware of being placed in the admin group by default. Is the admin group similar to the wheel group or is there also a wheel group for sudo access? And yes, I very seldom run scripts copied from somebody else so when I do, I make sure I know what is being run. Granted, I'm a Linux and Windows user so the OSX philosophy might be different.
  - 4ad 13y ago
    The admin group is what it's used for sudo by default.
- eli 13y ago
  You mean installing Homebrew itself? Because if you're running "sudo brew install foo" you're doing it wrong.
  - 13y ago

hunkop 13y ago

Root can do anything. If that's a vulnerability than the entire system is a vulnerability.

Steuard 13y ago

Not at all a safe assumption. Most importantly, it's not that uncommon for even less experienced Mac users to copy and paste Terminal commands to solve one problem or another. A lot of those "Just type this!" solutions I've seen involve sudo somewhere. But on top of that, maybe I don't understand your meaning here, but do you do a security audit on every line of every script that you ever run? Especially scripts that you run without sudo? I know that I don't.

mirkules 13y ago
"A lot of those "Just type this!" solutions I've seen involve sudo somewhere." Not sure if you're alluding to this trick: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste This particular exploit could be rather nasty when used in conjunction with the above.
- chc 13y ago
  Not even that. Lots of Mac help sites will include snippets of Bash code for the user to enter (say, something using rm to delete files the Finder is having trouble statting), and people will just enter those. You don't even need to do anything sneaky with the copy/paste process. Just offer some malicious code and expect the user to run it blindly since they wouldn't be coming to MacNoobHelp.com if they were capable of vetting for exploits.
ams6110 13y ago
Particularly installer scripts that are run by the trendy technique of curl -L http://www.example.com/some/cool/thing/install.sh | bash Particularly risky if the protocol is not https. Even worse when the right-hand command is "sudo bash"

traviscj 13y ago

A few points: - The default user created at setup of OSX is in the admin group. - Certainly the 'has run sudo' is a bit of a restriction, but even running something like the Homebrew install script runs sudo. (Maybe 'users that run Homebrew without understanding sudo' is an even smaller restriction, but a few members of my research group live in exactly this intersection!) - Do you habitually read every line of source code your computer would execute before you run that code?

zackkitzmiller 13y ago
Homebrew fails if you attempt to run it with sudo.
- traviscj 13y ago
  See my comment above. I'm not referring to running 'sudo homebrew ...', I'm talking about the installation, which has to run sudo to change some permissions in HOMEBREW_PREFIX.
wcchandler 13y ago
I was unaware of being placed in the admin group by default. Is the admin group similar to the wheel group or is there also a wheel group for sudo access? And yes, I very seldom run scripts copied from somebody else so when I do, I make sure I know what is being run. Granted, I'm a Linux and Windows user so the OSX philosophy might be different.
- 4ad 13y ago
  The admin group is what it's used for sudo by default.
eli 13y ago
You mean installing Homebrew itself? Because if you're running "sudo brew install foo" you're doing it wrong.
- 13y ago