CVE-2005-0716
Mac OS X 10.3.5-10.3.6 - Local Buffer Overflow via CF_CHARSET_PATH Environment Variable
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-0716. PoCs published by Kevin Finisterre, vade79.
AI-analyzed exploit summary This exploit targets a local privilege escalation vulnerability in macOS 10.3.7 by leveraging an environment variable overflow in the `authopen` utility. It uses a crafted `CF_CHARSET_PATH` and `APPL` environment variable to execute shellcode, granting root privileges.
Description
Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrary code via a long CF_CHARSET_PATH environment variable.
Exploits (2)
This exploit targets a local privilege escalation vulnerability in macOS 10.3.7 by leveraging an environment variable overflow in the `authopen` utility. It uses a crafted `CF_CHARSET_PATH` and `APPL` environment variable to execute shellcode, granting root privileges.
This exploit leverages a buffer overflow in the CF_CHARSET_PATH environment variable to execute arbitrary shellcode via the /usr/bin/su binary on MacOS X, granting root privileges. The user must press ENTER at the password prompt for successful exploitation.