sideeffect42/rootpipetesterRootPipe (CVE-2015-1130) and Phoenix (CVE-2015-3673) vulnerability testing utility for Mac OS X 10.2.8 and later
RootPipe Tester is a small application that runs on your Mac (Mac OS X 10.2.8 or higher, both PowerPC and Intel) and tries to use both the RootPipe (CVE-2015-1130) and Phoenix (CVE-2015-3673) exploits to produce a privilege escalation.
If your Mac is vulnerable does depend on the version of Mac OS X you are running but its success is also dependent on the preferences you have set.
With RootPipe Tester I have created a one-click solution for you to verify if you are vulnerable without having to do extensive testing and trying.
Download the disk image from the releases page of this repository or compile it by your own if you prefer.
Mount the disk image and run the application contained within it (it is safe to run RootPipe Tester from the disk image).
Click "Start Test" and let the test run through (you can tell if it's finished by the "Running…" in the window title).
To get accurate results I recommend rebooting your Mac and running the test again on a "fresh login".
If at least one of the test runs detected a vulnerable system you might want to check out the PANIC section.
No! Keep calm and read the guide appropriate to your system version.
Note: Not vulnerable in user authorization means that the system will either not grant access or pop up an authorization dialog which prompts you to authenticate as an Administrator user.
To some extent this is also a privilege escalation, because the admin group doesn't have as many rights as root, but in the default configuration of sudo, every user in the group "admin" can get root by entering his password, so the same effect can also be achieved by simply running sudo.
Upgrade to 10.10.3 as soon as possible to make sure the system enforces entitlements on the writeconfig binary correctly. (at least that's what Apple says)
If for some reason you cannot upgrade to 10.10.3, check the section for OS X 10.9 Mavericks.
Mavericks let's an exploiter get through with nil authorization so you're in a much more difficult situation than with older versions of Mac OS X.
You may want to have a look at can_I_suid.
Test results:
Vulnerable
You should enable "Require password to unlock each System Preferences pane" in the Security preference pane.
Test results:
Not vulnerable
Congratulations! You have one of the most secure versions of Mac OS X (at least as far as RootPipe is concerned).
On these systems, the "Require password to unlock each System Preference pane" ("Require password to unlock each secure system preference" in Tiger) in the Security preference pane is working properly and should really be enabled!
Note: If the "Require password" checkbox is unchecked, the system will unlock secure preference panes on each login. If you're using an Administrator account this will make your system vulnerable until you have manually closed the lock in the System Preferences after each login.
Test results:
Not vulnerable
Unlike on later systems, in Panther, the "Require password to unlock each secure system preference" checkbox in the Security preference pane does not have the effect of fully hindering this exploit from working. I still recommend checking it.
To secure your system I strongly recommend to switch to using a standard user account only and always manually "closing the lock" after changing preferences in System Preferences.
Only closing System Preferences will not properly invalidate the authorization and this exploit will work until you log out although the System Preferences GUI shows a closed lock as a Standard user.
Test results:
Not vulnerable
Unlike later systems, Jaguar does not provide a "Require password to unlock each secure system preference" checkbox but still unlocks secure preference panes at login for all Administrator users.
To secure your system I strongly recommend to switch to using a Standard user account only.
Note: Jaguar does not lock secure preference panes when System Preferences quits, so always lock secure panes manually. If you fail to do that, the exploit will work until you log out.
Note: If you can't switch to a standard user account a simple AppleScript which locks secure preference panes as a Login Item could do the job.
Note: The normal version of RootPipe Tester will not run on Jaguar. Download the Legacy version of RootPipe Tester if you want to run on Jaguar.
The Legacy version of RootPipe Tester is equivalent in functionality to the normal version, but is compiled using GCC 3.1 instead of GCC 4.0.
Test results:
Not vulnerable
