OS X Security: Diary of an OS X Leopard Server root exploit

Check for updates daily! The "weekly" default got my Xserve cracked.

First things first: Go to each of your systems running Leopard Server, up through release 10.5.2, and make sure that Security Update 2008-002 is installed. Download it from http://www.apple.com/support and install it manually if you're not sure. There is no harm in attempting to install an Apple update twice. There is great potential danger in leaving a Leopard Server system on-line without it.

In mid-April, I was set upon by some 'nethole that I managed to flush out of my Xserve while he was still wriggling and, by luck, before he had made my server his own. Or so I thought. I documented this attack in some detail prior to investigating its cause, an investigation I recently found time to complete. The results afforded me some insight into the realization, life, death and resurrection of a potential exploit, and the effects that each stage brings with it.

The potential exploit at issue is listed in the US-CERT National Vulnerability Database as CVE-2007-4560. As reported by the person credited with its discovery, inbound e-mail received via a mail transfer agent (the MTA queues incoming e-mail for local delivery, relay or bounce) and filtered through the ClamAV anti-virus "milter" daemon could allow execution of arbitrary shell commands. To be vulnerable, ClamAV has to be operating in black hole mode, which attempts to discard undeliverable messages without scanning them or passing them down to your mail delivery agent. To achieve this, um, efficiency, ClamAV must run at the elevated privileges of your mail delivery agent (e.g. Sendmail) so that ClamAV can access mail files directly to judge deliverability.

ClamAV's black hole mode bypasses SMTP logs, making the tracing of the problem loads of fun.

Flipping black hole mode on wasn't my idea. ClamAV is one thing I trusted to the checkbox in Server Admin. I didn't really need ClamAV, which functions primarily to protect Windows users from mail-borne malware.

CERT rated this ClamAV exploit's risk at HIGH, while rating its complexity HIGH as well, meaning that it's a trick that only the brighter among delinquents can carry from potential to live exploit status. The dyslexic enuretics that commit most Internet felonies couldn't get a bowling ball through a doggie door without a gift-wrapped exploit script and a pack of IRC LOL-lies tutoring them on its use.