iDefense Security Advisory 05.24.07 – Local exploitation of a privilege escalation vulnerability in Apple Computer Inc.’s Mac OS X pppd could allow an attacker to gain root privileges. The vulnerability exists due to insufficient access validation when processing the “plugin” command line option. The application does not properly verify that the requesting user has root privileges and allows any user to load plug-ins. When checking to see if the executing user has root privileges, a check is made to see if the stdin file descriptor is owned by root. Passing this check is trivial and allows the attacker to load arbitrary plug-ins resulting in arbitrary code execution with root privileges. iDefense has confirmed the existence of this vulnerability in version 10.4.8 of Mac OS X. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/56944/05.24.07-1.txt
Source: https://packetstormsecurity.com/files/56944/iDEFENSE-Security-Advisory-2007-05-24.1.html