Matasano Chargen - Latest Comments in Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

Re: Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

rjohnson — Tue, 03 Oct 2006 00:30:58 -0000

Nemo published some related work in Uninformed back in March. He did a good job of explaining the core fundamentals of the Mach subsystem in OSX and demonstrated various methods of subverting the BSD security features using the Mach subsystem. Definitely a good read.

Re: Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

Steve Christey — Mon, 02 Oct 2006 14:59:38 -0000

Great work. Privilege chaining issues are cool.

Re: Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

Nate — Mon, 02 Oct 2006 10:44:39 -0000

Vendor disclosure's not broken!

Re: Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

Dino — Mon, 02 Oct 2006 10:12:44 -0000

Hello Ilja,

I wouldn't be surprised if there are some way older slightly less-than-public exploits for it also, the bug has been around for a long while. Once I get NeXTSTEP 3.3 running in a VM, I'll see if they had the bug also :).

Re: Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation

ilja — Mon, 02 Oct 2006 00:04:00 -0000

there's been a public exploit out for this bug for about a year I think. Nice apple finally fixed it :)