Exploitation Summary
EIP tracks 1 public exploit for CVE-2005-2713. PoCs published by vade79.
AI-analyzed exploit summary This exploit leverages a vulnerability in OSX's /usr/bin/passwd to overwrite /etc/sudoers by predicting the temporary file path used during password changes. It creates a fake passwd file and symlinks /etc/sudoers to the predictable temp file, allowing arbitrary file write and privilege escalation.
Description
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbitrary world-writable files as root by specifying an alternate file in the password database option.
Exploits (1)
This exploit leverages a vulnerability in OSX's /usr/bin/passwd to overwrite /etc/sudoers by predicting the temporary file path used during password changes. It creates a fake passwd file and symlinks /etc/sudoers to the predictable temp file, allowing arbitrary file write and privilege escalation.