| Sign Up! |
The Securosis Daily DigestThe Friday Summary |
|
| Project Quant |
Take the Project Quant Open Patch Management Survey |
Click Here for Project QuantThe patch management metrics project. |
|
|
| Entries Calendar | |||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Just a quick note- if you used chmod to change the permissions of ARDAgent to block the privilege escalation vulnerability being used by the new trojans you should still go compress or remove it. Repairing permissions restores ARDAgent and opens the vulnerability again.
I suppose you could also make sure you don't repair permissions, but it's easiest to just remove it.
I removed the chmod recommendation from the TidBITS article.
—Rich
Posted at Thursday 26th June 2008 2:02 am Filed under: apple • geek • vulnerabilities
If you like to leave comments, and aren't a spammer, register for the site and email us at info@securosis.com and we'll turn off moderation for your account.
What about those of us who work in an IT environment in which we are *required* to run ARD?
Just running ARDAgent closes a bunch of the ways this can be exploited. Other than that, you’‘ll need to wait for a patch. Again, this is a really low risk vulenrability.
I am somewhat surprised that so few people are using Martin Kou’s approach which seems a lot more useful.
<a href="http://martinkou.blogspot.com/2008/06/how-to-properly-fix-mac-os-x-ardagent.html" rel="nofollow">http://martinkou.blogspot.com/2008/06/how-to-properly-fix-mac-os-x-ardagent.html</a>
The idea is to make ARDAgent pay attention to it’s dictionary, which is empty so far as I can tell.
There may yet be a hole in there, but its no longer able to run arbitrary shell scripts.
