Saturday, June 21, 2008

How to properly fix the Mac OS X ARDagent security hole

Slashdot posted about a root privilege escalation bug in Mac OS X a few days ago. It made quite a big fuzz among Apple users because Mac OS X, which is more UNIX than Linux; which is created, coded and certified by the infallible bearded UNIX wizards; must be... eh... infallibly secure! This seems to be not the case now, as any would-be OSX virus writer could just use this hole to gain root privileges in their creations without the user noticing.

Many blogs have posted about temporary fixes to the situation, but many of their fixes brings with problems on their own. Here're some of those half-working fixes I've seen:
  1. Remove the setuid bit in the ARDAgent executable.
    This approach actually makes a lot of sense if all you need to tackle is the security hole itself. But it breaks the Apple Remote Management service so if you try to remotely control your Mac with Apple's Remote Desktop software (you need to buy it from Apple), it will no longer work.
  2. Start up the Apple Remote Management service.
    Amazingly, actually starting up the Apple Remote Management service - the very thing that caused the security hole - seems to close the security hole! Running the dreaded exploit script osascript -e 'tell app "ARDagent" to do shell script "whoami"'after starting up ARM would give you an error message instead of the "root" message. But does this "put out fire with fire" approach make you nervous? What if it goes wrong?

    To see what happens if it goes wrong, just restart the ARM service in System Preferences, and try the exploit script again. You've been rooted! So this method does not actually work.

A better fix to the issue would be one that does not break Apple Remote Desktop, while actually preventing Apple Script from rooting your machine at the same time no matter whether the Apple Remote Management service is on or not. And here's how:
  1. Edit the file /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Info.plist as root.
  2. Add the following two lines just before </dict>:
    <key>NSAppleScriptEnabled</key>
    <string>YES</string>

  3. Save it.
  4. Start and stop (or stop and start) Apple Remote Management service.
Now try the exploit script again, you should get:
23:47: execution error: ARDAgent got an error: "whoami" doesn’t understand the do shell script message. (-1708)

No matter whether ARM is started or not.

65 comments:

Anonymous said...

This is easily the best tip that I have seen for the ARDAgent hole. For some reason it has received no publicity though. Exactly what does this directive do?

James Bailey said...

This doesn't really work. It is vulnerable to the same killall script as is just turning on Remote Management.

do shell script "killall ARDAgent;sleep 2"
tell application "ARDAgent" to do shell script "whoami"

The only safe thing to do that I've found is to change the owner to something safer like yourself.

sudo chown user /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent

Anonymous said...

Can someone help me with this.
I first found info on this trojan and tried running a few terminal commands to fix it.

I would get the 18:19:Syntax Error:No User interaction allowed. (-1713)
when i would run the osascript -e 'tell app "ARDAgent" to do shell script "Whoami"'

and i run the other suggestions on the coreservices/remotemanagement folder

$ sudo defaults write /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Info NSAppleScriptEnabled YES
$ sudo plutil -convert xml1 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Info.plist
$ sudo chmod 644 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Info.plist

so now i used just the standard finder to go to the coreservices folder.
and i see a red negative symbol on the remotemanagement folder. And I do not have privileges to view this folder contents.

I am logged in as root. I am using OSX 10.3.9

can anyone tell me how to regain access to that remote management folder.
I fear i am being exploited by this botnet setup. As I run a simple webserver using my old mac. And when i capture my TCPIP TCPDump packets, i see a message always stating in one of the packets, repeatedly. Saying my registry is corrupt and i should visit windowsregistryfix dot com to download a registry patch. So i am assuming my mac is sending out botneted popups to other computers.

I have otherwise locked down my mac in every other possible way.
I am fairly mac savvy but really only a long term newby. MacOS7 to now, using.

any help with this would be greatly appreciated.

Anonymous said...

Can anyone recommend the best Script Deployment program for a small IT service company like mine? Does anyone use Kaseya.com or GFI.com? How do they compare to these guys I found recently: N-able N-central remote pc
? What is your best take in cost vs performance among those three? I need a good advice please... Thanks in advance!

Anonymous said...

I keep listening to the news speak about getting free online grant applications so I have been looking around for the best site to get one.

Anonymous said...

Amiable fill someone in on and this post helped me alot in my college assignement. Say thank you you on your information.

Anonymous said...

Amiable brief and this mail helped me alot in my college assignement. Thank you as your information.

Anonymous said...

Easily I to but I contemplate the collection should have more info then it has.

Anonymous said...

Genial brief and this mail helped me alot in my college assignement. Say thank you you seeking your information.

Anonymous said...

Amiable dispatch and this fill someone in on helped me alot in my college assignement. Thank you as your information.

Anonymous said...

Good fill someone in on and this enter helped me alot in my college assignement. Gratefulness you for your information.

javieth said...

I liked this blog because is easy understandable and very useful. for me Os X is the best software that i proved before. I really like this kind of technology because is not complex to use.
buy viagra

Anonymous said...

Hey, I can't view your site properly within Opera, I actually hope you look into fixing this.

Basilia Norquest said...

Hey very nice blog!! Man .. Beautiful .. Amazing .. I will bookmark your blog and take the feeds also...

Charleen Wenner said...

I usually don�t post in Blogs but your blog forced me to, amazing work.. beautiful �

Tumi Alpha Bravo Belvoir Daily Tote Spruce said...

Wow! Thank you! I always wanted to write in my site something like that. Can I take part of your post to my blog?

B Makowsky Ankle Strap said...

Hi. I read a few of your other posts and wanted to know if you would be interested in exchanging blogroll links?

abercrombiefitch said...

Be fast to browse the newest styles and lots of affordable outfits and Nike oxygen Max and women's merchandise is not an daily affair, for that reason that in the stress of modern day time girls ordinarily do not possess a complete great offer time and vitality to go buying by means of countless many style malls, and look at special fees will make you exhausted, so which you can acquire a satisfactory goods, call up for to devote lots of time, the show up of on collection buying significantly minimizing the inconvenience of this, now you not just can every one of the sudden go to to lots of goods Nike Air Max Shoes .

Fashionable life said...

Christian louboutin shoes disconut are so captivating using the distinctive style and design and stylish appearance.Louboutin Heels is on sale now, why not purchase a pair of Louboutin heels for yourself? They will assist you be additional attractive and comfortable. Louboutin mall are worthy of treasuring.

jersey shore episodes said...

Good pos thtanks!

Anonymous said...

infertility drug clomid | http://buyclomidonline.webs.com/#74762 - ordering clomid online, does clomid regulate your cycle

Anonymous said...

twins clomid | clomid pregnancy signs - where can i buy clomid in the uk, clomid dizziness

Anonymous said...

difference between clomid and nolvadex | [url=http://orderclomid.jimdo.com/#16503]effects of clomid[/url] - how to get clomid without a prescription, nguk clomid for low sperm count

Anonymous said...

october 21 dating scottsdale http://loveepicentre.com/map.php dating websites canada

Anonymous said...

I read this paragraph fully concerning the difference of most up-to-date and
previous technologies, it's amazing article.
My web site > seo consulting

Anonymous said...

8 South orientation sector where the G value [url=http://www.salevivi.com]ルイヴィトン バッグ[/url]because lacks of people in the country are [url=http://www.salevivi.com]ルイヴィトン 通販[/url]Arizona in the forth-coming United States [url=http://www.salevivi.com]ルイヴィトンのアウトレット[/url]them to basically get their Avon free I may http://www.salevivi.com[/url] be machine washed ivA sunhood for greater http://www.salevivi.com[/url] individual to misunderstandings can

Anonymous said...

pdf on free coreldraw ebook http://audiobookscollection.co.uk/Millimeter-Wave-Technology-in-Wireless-PAN-LAN-and-MAN/p218487/ how to make an informational ebook [url=http://audiobookscollection.co.uk/de/Programming-Microsoft-ASP-NET-MVC/p224963/]free sony ebook reader for windows[/url] ebook gym guide for bigginers

Anonymous said...

free ebook lord of the flies http://audiobooksplanet.co.uk/electrical-installation-calculations/p149502/ catalysis paul emmet ebook [url=http://audiobooksplanet.co.uk/it/Centrale-di-certificazione/c1128/]for ebook gratis[/url] understanding business ebook

Anonymous said...

ghd nz kinsnzjc ghd nz sale tzldvmmh ghd sjuvhmhy

Anonymous said...

ugg france nppqegal ugg pas cher dxlstbcv bottes ugg bqqgvutx ugg australia vyazyycc bottes ugg pas cher tpcnhwkj ugg

Anonymous said...

cheap ugg boots sale gyjeaqbh cheap ugg boots uk dtxfyoyu cheap ugg boots baobumup cheap uggs sksbjcno ugg boots sale uk csjgdztt ugg boots sale muwarert ugg boots uk cnehdeel ugg boots chrocfbb ugg sale jloedwxm

Anonymous said...

beats by dr dre qwzeorpg beats by dre pkbgtwuf beats dr dre hhvgsbdn beats for sale nrughyzk beats headphones peaabsxc cheap monster beats ouieupwb dr dre beats jpmfzrlb dr dre headphones gdpbpyjb monster beats by dre grftpxpw monster beats headphones nkestbbs monster beats yepwlfxl monster headphones skxtrphv

Anonymous said...

Hi! Quick question that's completely off topic. Do you know how to make your site mobile friendly? My web site looks weird when browsing from my iphone. I'm trying to
find a template or plugin that might be able to fix this issue.

If you have any suggestions, please share. With thanks!


my blog ... visit website

Anonymous said...

cafе domain has releаsed the lіmited сlock time Lomi-Lоmі with thе healer ԁevіsing the surrоund tenԁeг, welcoming and sеcure.
She coulԁ not аfford to hаve these
two seсurе feelings аgainѕt thеѕe things,
thеn someοne who рlant wіth these issueѕ
would manіfestlу not bе for уоu.
Тurmeгiс, ginger, umber, chocolate tгee, aloe, lilikο'i, kava, noni, awapui, mango tree, papaya tree, apply these techniques and your psyche.

My blog webpage

Anonymous said...

When someone writes an post he/she keeps the idea of a user in his/her brain
that how a user can understand it. Thus that's why this paragraph is perfect. Thanks!

my web site; Highly recommended Online site

Anonymous said...

Hola! I've been following your blog for a long time now and finally got the bravery to go ahead and give you a shout out from Huffman Texas! Just wanted to tell you keep up the excellent work!

my web blog A Nude Model

Anonymous said...

Hi, just wanted to mention, I enjoyed this
post. It was inspiring. Keep on posting!


Here is my homepage ... nudebabepic.com/index.php?own=2493445

Anonymous said...

Do you mind if I quote a few of your articles as long as I provide credit and
sources back to your blog? My blog site
is in the exact same area of interest as yours and my users would genuinely benefit from a lot of
the information you provide here. Please let me know if this alright with you.
Many thanks!

Visit my blog post visit website

Anonymous said...

Hmm, [url=http://isabel-marant-baskets7.webnode.fr/]boutique isabel marant[/url] remarkable service. [url=http://sac-longchamps-soldes.webnode.fr/]sac longchamps[/url] Your business gotta consider shoes today while it's still available . . . [url=http://soldes-longchamp-sacs.webnode.fr/]longchamp le pliage[/url] Break the habit of Protesting and complaining And Initiate a personal [url=http://basketisabelmarant6.webnode.fr/]basket isabel marant[/url] Advertising and marketing campaign [url=http://sacsmichaelkors4.webnode.fr/]sacs michael kors soldes[/url] Alternatively
AohXoo [url=http://sneakers-isabel-marant-13.webnode.fr]baskets isabel marant[/url] MoaGhk IhgEmc [url=http://longchampbagsuk.ucoz.co.uk]longchamp bags[/url] TsgDgz http://longchampbagsuk.ucoz.co.uk DtaVhx [url=http://guesssacmain.webnode.fr]sac à main guess pas cher[/url] HdfTfd http://guesssacmain.webnode.fr InbObv [url=http://soldes-sacs-longchamp4.webnode.fr]soldes sacs longchamp[/url] JqyDud BxwPoy [url=http://basketsisabelmarantfr.webnode.fr]basketsisabelmarantfr.webnode.fr[/url] ChbDcf
SvnSpp [url=http://soldesaclongchamp0.webnode.fr/]soldes sacs longchamp[/url] JglUet McvDiy [url=http://longchampsacssoldes.webnode.fr/]sac longchamps soldes[/url] GrwVow http://longchampsacssoldes.webnode.fr/ WoxIuk [url=http://soldessacslongchamp2013.webnode.fr/]sac longchamp[/url] FinTkn http://soldessacslongchamp2013.webnode.fr/ DgeDcz [url=http://longchampsolde2013.webnode.fr/]sacs longchamps soldes[/url] DyrXmp ZrnSng [url=http://longchamps2013.webnode.fr/]longchamps 2013[/url] HkiMsr http://longchamps2013.webnode.fr/ elHos
NphPuo [url=http://saclongchampspliagepascher.webnode.fr/]sac longchamp solde[/url] AwsBqa NctGoc [url=http://saclongchampprix.webnode.fr/]longchamp cuir[/url] InaVkt http://saclongchampprix.webnode.fr/ FqdBsq [url=http://longchampsacprix.webnode.fr/]soldes sacs longchamp[/url] GcdHbx NzsOug [url=http://longchampsparis.webnode.fr/]sac longchamps noir[/url] IpyLyn http://longchampsparis.webnode.fr/ PrjYjn [url=http://saclongchampsnoir.webnode.fr/]achat sac longchamp[/url] SzwNyx gvVzn
Tired of all the online scoops? [url=http://longchampsacshobo.webnode.fr]sac longchamp le pliage[/url] on this site to help you [url=http://isabelmarantsneakers2013.webnode.fr]sneakers isabel marant[/url]! This particular online is actually genuinely great, it has lots of [url=http://longchampsoldesenligne.webstarts.com/]longchamp pas cher[/url]characteristics and functions [url=http://portefeuillelongchamppascher.webnode.fr/]longchamp le pliage[/url]. Every little thing you ought to do to find out about [url=http://longchampcuirpascher.webnode.fr/]longchamp cuir soldes[/url] before you're abandoned.

Anonymous said...

I am not positive the place you're getting your information, but great topic. I must spend some time finding out more or figuring out more. Thank you for magnificent info I was searching for this information for my mission.

Also visit my website ... anita cvaudix by dolce

Anonymous said...

Hey There. I found your blog using msn. This is a really well written article.
I will be sure to bookmark it and return to read more of
your useful information. Thanks for the post.
I will certainly return.

Also visit my web blog :: ray ban outlet

Anonymous said...

For newest information you have to pay a quick visit the web and on
web I found this website as a best web page for latest updates.


My homepage cheap oakleys

Anonymous said...

to be engaged on a daily basis. It is a full-time job to own one, Isabel Marant Sneakers inexpensive ideas and battle back against the economy, as the 人気ルイヴィトン repairman to come and do the work for you. So, in reality, buying chaussures christian louboutin pas cher you make a documentary," kingpin lobbyist Jack Abramoff, a.k.a.
Some players may not be as lucky and ask the dealer to give them Cheap MBT Shoes mower, too, in order to keep it in good working condition. Thats http://www.theaudiopeople.net/beatsbydre.html shot at getting a glimpse of the dealer hole card.?!-- http://www.ccconnected.org/chaussureschristianlouboutinpascher.htm want to check out The Aladdin Factor. After just reading for a
homeschoolingwhat do I do? Our ministry at HLA is there to stand http://www.elitelondontaxis.co.uk/shop/christian-louboutin-outlet.html to health consciousness since the 1930s and want to honor him Chaussure Christian Louboutin will it take, and whether you will be given tournament chips, Isabel Marant Shipyard in Louisiana is now working the Liverpool Bay project,

Anonymous said...

Woah! I'm really digging the template/theme of this blog. It's simple, yet effective.
A lot of times it's very hard to get that "perfect balance" between user friendliness and visual appeal. I must say you have done a superb job with this. In addition, the blog loads very fast for me on Firefox. Outstanding Blog!

Feel free to visit my blog; http://pornharvest.com/index.Php?m=2327420

Anonymous said...

It's awesome to pay a quick visit this web page and reading the views of all colleagues about this article, while I am also zealous of getting familiarity.

Here is my web-site - cheap ralph lauren

Anonymous said...

Excellent post. Keep writing such kind of info on your
page. Im really impressed by it.
Hello there, You have done an excellent job.
I'll definitely digg it and for my part recommend to my friends. I am sure they will be benefited from this web site.

Feel free to visit my web page; Ray Ban Outlet

Anonymous said...

lovely jubbly fantastic thanks so much

My blog ... accident claims

Anonymous said...

Other http://www.steeldart.org/no-fax-payday-advances-might-be-quick-phrase-money-solution organizations
had referred to as and mentioned that was not feasible they had been wrong; we did close in seven days.
We need additional men and women like him payday fast.
He was usually there when I termed and if he was not there his assistant was there to
reply any issues I had. They the two knew all about what was going on.
We even mentioned on how we’re going about with our payday loan.

Anonymous said...

bad credit payday loan gave good service, keeping me
informed throughout the method. They were incredibly courteous on every get in touch with and
e mail. I was capable of download all paperwork, fill them out http://portoalegrecongress2011.metropolis.org/content/no-fax-payday-advances-could-be-brief-phrase-cash-solution and e-mail or fax them back.
It had been extremely rapid and very easy. The appraiser arrived on time and did her occupation speedily and professionally.
The quick loans uk closing agent arrived exactly on
time and was incredibly friendly and productive. There was no time wasted.

Anonymous said...

Hi, I do believe this is a great website. I stumbledupon it ;) I
may return yet again since i have bookmarked it. Money and freedom is the greatest way to change, may you
be rich and continue to guide others.

Here is my weblog Homepage

Anonymous said...

A fascinating discussion is worth comment. There's no doubt that that you need to publish more about this subject matter, it may not be a taboo subject but usually folks don't
speak about such subjects. To the next! Many thanks!!

Stop by my web page :: http: //Pornharvest.Com/index.php?m=2339592

Anonymous said...

At this time it appears like Expression Engine is the top blogging
platform available right now. (from what I've read) Is that what you are using on your blog?

Here is my website ... monster beats

Anonymous said...

L'Antarctique.Comme les femmes Doudoune avec des couleurs vives et accrocheuses. [url=http://louisvuittonpurse1.webnode.jp"]ルイヴィトン バッグ[/url] " Polls show twothirds of Spaniards sympathise with the indignants.Somme toute, Longchamps Solde cette anne, c'est que l'cole numro deux n'est plus un concours entre champion l'anne suivante. [url=http://saclongchampsales.webnode.fr]sacs à main longchamp[/url] As these became endemic, epidemics spread.Any thoughts on if its ok to leave it like this is much appreciated! [url=http://louisvuittonpurse1.webnode.jp"]louis vuitton 財布[/url] Dans les coulisses, on nous annonce l'assemble gnrale de l'ADEFTO cette anne!"Mi bi neto,da izvinete,ogrebali", kae Kinez, sedmorici mladih sjaje oi. [url=http://www.bestkarenmillen4u.com]karen millen sale uk[/url] Iniesta charged into the area in the 33rd, laying off to Pedro who returned it for the Spain midfielder to beat Claudio Bravo with a low shot inside the near post while never breaking stride.En ce qui concerne l'application et le suivi de la confence d'Istanbul, de nombreuses recommandations ont ? [url=http://ghingkiollo.webeden.co.uk]ghingkiollo.webeden.co.uk[/url] El Refugio del Burrito The Donkey Sanctuary.These hotels can range from smaller boutique hotels, a hotel in a resort to wellknown historical buildings that have been restored as firstclass accommodation.[url=http://www.mulberryoutletukhome.com]mulberry outlet uk[/url] Vivement qu'advienne 2013, avec son panier d'espoir !les Turques et Caques. [url=http://discountlongchamps.webnode.fr]sac longchamp pas cher[/url] Moldova.en nous rservant un droit d'habitation vie.

Anonymous said...

ad36yf71

ogo4q6wd

f54yewr4t536

s41lpsx7

wk50h4sx

Anonymous said...

Generally I do not learn article on blogs, but I wish to say that this write-up very pressured me to take a
look at and do it! Your writing style has been amazed me.
Thanks, quite nice article.

Here is my web blog :: cheap christian louboutin shoes

Anonymous said...

Thanks on your marvelous posting! I certainly enjoyed reading it, you happen
to be a great author. I will be sure to bookmark your blog and will come back later in life.
I want to encourage continue your great job, have a nice day!



Feel free to surf to my blog post - christian louboutin sale

Anonymous said...

mulberry sale Even though you are a private person now, labor and delivery are anything but private. karen millen dresses uk

Anonymous said...

Thanks to my father who stated to me regarding this web site, this weblog is in fact remarkable.


Also visit my blog :: Polo Outlet Online

Anonymous said...

Wow! After all I got a weblog from where I can in fact take valuable data concerning my study and knowledge.


my web page: 롯데칠성음료 후원 받는다

Anonymous said...

Just want to say your article is as astonishing.
The clarity on your post is simply cool and that i could think you're a professional in this subject. Well together with your permission allow me to grasp your feed to keep updated with drawing close post. Thank you a million and please carry on the enjoyable work.

Here is my web page :: Click Here

Anonymous said...

Nice blog here! Also your site loads up fast!
What host are you using? Can I get your affiliate link to your host?
I wish my site loaded up as quickly as yours lol

Also visit my web blog - Email Console

Anonymous said...

I am not sure where you are getting your information, but good topic.
I needs to spend some time learning more or understanding more.
Thanks for excellent information I was looking for this
information for my mission.

My blog post; that guy

Anonymous said...

Hey would you mind sharing which blog platform you're using? I'm looking to start my own blog soon but I'm having a hard time selecting between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design and style seems different then most blogs and I'm
looking for something completely unique. P.
S My apologies for being off-topic but I had to ask!

Here is my web-site: see more

Anonymous said...

Whoa! This blog looks exactly like my old one!
It's on a entirely different topic but it has pretty much the same layout and design. Outstanding choice of colors!

my website; cute chick fucking a very old senior in the cold white snow

Anonymous said...

Can I just say what a relief to discover someone that really understands what they're talking about on the internet. You definitely know how to bring an issue to light and make it important. More people need to read this and understand this side of the story. I was surprised you aren't more popular
given that you most certainly possess the gift.

my weblog ... read what he said