Hi! This is the ezmlm program. I'm managing the
bugtraq@securityfocus.com mailing list.

I'm working for my owner, who can be reached
at bugtraq-owner@securityfocus.com.

Messages to you from the bugtraq mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the bugtraq mailing list,
without further notice.

I've kept a list of which messages from the bugtraq mailing list have
bounced from your address.

Copies of these messages may be in the archive.

To retrieve a set of messages 123-145 (a maximum of 100 per request),
send an empty message to:
<bugtraq-get.123_145@securityfocus.com>

To receive a subject and author list for the last 100 or so messages,
send an empty message to:
<bugtraq-index@securityfocus.com>

Here are the message numbers:

19945
19949
19948
19944
19946
19947
19950
19951
19952
19953
19955
19954
19958
19964
19966
19970
19971
19961
19963
19969
19957
19967
19960
19965
19962
19956
19959
19968
19972
19973
--- Enclosed is a copy of the bounce message I received.
Return-Path: <>
Received: (qmail 553 invoked from network); 10 Jun 2005 10:18:40 -0000
Received: from mail2.securityfocus.com (205.206.231.1)
by lists2.securityfocus.com with SMTP; 10 Jun 2005 10:18:40 -0000
Received: (qmail 8984 invoked by alias); 10 Jun 2005 17:33:44 -0000
Received: (qmail 8980 invoked from network); 10 Jun 2005 17:33:44 -0000
Received: from freebsd.csie.nctu.edu.tw (140.113.17.209)
by mail2.securityfocus.com with SMTP; 10 Jun 2005 17:33:44 -0000
Received: from freebsd.csie.nctu.edu.tw ([140.113.17.209]) by freebsd.csie.nctu.edu.tw
via smtpd (for mail2.securityfocus.com [205.206.231.1]) with ESMTP; Fri, 10 Jun 2005 10:55:19 -0700
Received: by FreeBSD.csie.nctu.edu.tw (Postfix)
id 1E6D37ED7E; Sat, 11 Jun 2005 01:55:19 +0800 (CST)
Date: Sat, 11 Jun 2005 01:55:19 +0800 (CST)
From: MAILER-DAEMON@FreeBSD.csie.nctu.edu.tw (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-19945-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="E45C17ED81.1118426119/FreeBSD.csie.nctu.edu.tw"
Message-Id: <20050610175519.1E6D37ED7E@FreeBSD.csie.nctu.edu.t w>

This is a MIME-encapsulated message.

--E45C17ED81.1118426119/FreeBSD.csie.nctu.edu.tw
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host FreeBSD.csie.nctu.edu.tw.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The Postfix program

<bugtraq@freebsd.csie.nctu.edu.tw>: Command died with status 255:
"/usr/local/news/bin/mail-post.pl mailing.unix.bugtraq". Command output:
mail-post.pl: can't find inews

--E45C17ED81.1118426119/FreeBSD.csie.nctu.edu.tw
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; FreeBSD.csie.nctu.edu.tw
X-Postfix-Queue-ID: E45C17ED81
X-Postfix-Sender: rfc822; bugtraq-return-19945-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
Arrival-Date: Sat, 11 Jun 2005 01:55:18 +0800 (CST)

Final-Recipient: rfc822; bugtraq@freebsd.csie.nctu.edu.tw
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; Command died with status 255:
"/usr/local/news/bin/mail-post.pl mailing.unix.bugtraq". Command output:
mail-post.pl: can't find inews

--E45C17ED81.1118426119/FreeBSD.csie.nctu.edu.tw
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from localhost (localhost.csie.nctu.edu.tw [127.0.0.1])
by FreeBSD.csie.nctu.edu.tw (Postfix) with ESMTP id E45C17ED81
for <bugtraq@freebsd.csie.nctu.edu.tw>; Sat, 11 Jun 2005 01:55:18 +0800 (CST)
Received: from FreeBSD.csie.nctu.edu.tw ([127.0.0.1])
by localhost (FreeBSD.csie.nctu.edu.tw [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 68790-02 for <bugtraq@freebsd.csie.nctu.edu.tw>;
Sat, 11 Jun 2005 01:55:18 +0800 (CST)
Received: from mgate1.csie.nctu.edu.tw (mgate1 [140.113.17.201])
by FreeBSD.csie.nctu.edu.tw (Postfix) with ESMTP id 5C33F7ED7E
for <bugtraq@freebsd.csie.nctu.edu.tw>; Sat, 11 Jun 2005 01:55:17 +0800 (CST)
Received: from localhost (localhost [127.0.0.1])
by localhost (Postfix) with ESMTP id 022885D44ED
for <bugtraq@freebsd.csie.nctu.edu.tw>; Sat, 11 Jun 2005 01:55:18 +0800 (CST)
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mgate1.csie.nctu.edu.tw (Postfix) with ESMTP id 4692F5D4759
for <bugtraq@freebsd.csie.nctu.edu.tw>; Sat, 11 Jun 2005 01:54:32 +0800 (CST)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
via smtpd (for mgate1.csie.nctu.edu.tw [140.113.17.201]) with ESMTP; Fri, 10 Jun 2005 10:54:31 -0700
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id C67411490B9; Fri, 10 Jun 2005 11:28:28 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 28878 invoked from network); 10 Jun 2005 06:53:56 -0000
User-Agent: Microsoft-Entourage/11.1.0.040913
Date: Fri, 10 Jun 2005 16:30:29 +0200
Subject: Re:[ Suresec Advisories ] - Mac OS X 10.4 - launchd local root
vulnerability
From: Jonathan Weiss <jw@innerewut.de>
To: "[ Suresec Advisories ]" <advisories@suresec.org>,
BugTraq <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>,
<full-disclosure@lists.grok.org.uk>
Message-ID: <BECF70A5.2742B%jw@innerewut.de>
In-Reply-To: <1D728B0E-D8E7-42DF-A5B7-3622FB50AE50@suresec.org>
Mime-version: 1.0
Content-type: text/plain;
charset="US-ASCII"
Content-transfer-encoding: 7bit

> Securesec Security Advisory - #00003
> 09/06/05
>
> Apple Mac OS X 10.4 launchd race condition vulnerability
> Advisory: http://www.suresec.org/advisories/adv3.pdf
>
> Description:
>
> A race condition vulnerability has been found in the temporary file
> creation done by the suid launchd program on Mac OSX 10.4.
> The for advisory for this can be downloaded from the Suresec website.
>
> Risk:
>
> Successful exploitation of this vulnerability results in stolen
> ownership of any file on the system. Using this it is trivial to get
> a root shell.
>


Is this fixed by the security update issued by apple some days ago?

> Credit:
>
> The vulnerability was discovered by Neil Archibald and Ilja Van Sprundel
>
Jonathan

--

Jonathan Weiss
jw@innerewut.de
http://blog.innerewut.de



--E45C17ED81.1118426119/FreeBSD.csie.nctu.edu.tw--