Summaryinfo

A vulnerability marked as critical has been reported in Apple Mac OS X up to 10.8.3. This issue affects the function posix_spawn of the component XNU Kernel. This manipulation of the argument _POSIX_SPAWN_ALLOW_DATA_EXEC/_POSIX_SPAWN_DISABLE_ASLR causes access control. This vulnerability appears as CVE-2013-3949. There is no available exploit.

Detailsinfo

A vulnerability has been found in Apple Mac OS X up to 10.8.3 (Operating System) and classified as critical. Affected by this vulnerability is the function posix_spawn of the component XNU Kernel. The manipulation of the argument _POSIX_SPAWN_ALLOW_DATA_EXEC/_POSIX_SPAWN_DISABLE_ASLR with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the posix_spawnattr_setflags function.

The weakness was presented 04/26/2013 by Stefan Esser with SektionEins GmbH as not defined article (Website). The advisory is shared at antid0te.com. The public release happened without involvement of Apple. This vulnerability is known as CVE-2013-3949 since 06/05/2013. The exploitation appears to be difficult. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/20/2018). MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (93958†). See VDB-9014, VDB-9015, VDB-9016 and VDB-9017 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• Mac OS X

Version

• 10.8
• 10.8.1
• 10.8.2
• 10.8.3

License

• commercial

Support

• end of life

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion