Re: Cocoa can be used to execute arbitrary (privileged) code !
Re: Cocoa can be used to execute arbitrary (privileged) code !
- Subject: Re: Cocoa can be used to execute arbitrary (privileged) code !
- From: Andrew Farmer <email@hidden>
- Date: Thu, 19 Jun 2008 18:40:08 -0700
On 19 Jun 08, at 07:22, Jerry LeVan wrote:
Last night while browsing Slashdot I found this:
http://it.slashdot.org/it/08/06/18/1919224.shtml
It gives a simple command that can be used to
basically execute code as root.
osascript -e 'tell app "ARDAgent" to do shell script "whoami"'
The above will print "root" and replacing "whoami" will other
commands will cause the commands to be executed as root.
Looks like a job for NSTask...
Don't - seriously, just don't. This is a bug (and a rather serious
one, too) - using it as an alternative to Authentication just means
that your code will stop working on the next security update.
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden