Trusted Design

Dropbox < 3.3.x - OSX FinderLoadBundle Local Root Exploit

概要

The setuid root FinderLoadBundle that was included in older DropboxHelperTools versions for OS X allows loading of dynamically linked shared libraries that are residing in the same directory. The directory in which FinderLoadBundle is located is owned by root and that prevents placing arbitrary files there. But creating a hard link from FinderLoadBundle to somewhere in a directory in /tmp circumvents that protection thus making it possible to load a shared library containing a payload which creates a root shell.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Synology Cloud Station sync client for OS X (score: 0.45)
• Mac OS X "tpwn" Privilege Escalation (score: 0.39)
• Linux/BillGates backdoor ddoser ELF one, not rootkit/dropper (score: 0.35)
• Romanian Shellshock Backdoor (score: 0.35)
• Probing for shell exploits uploaded using file/image uploaders. (score: 0.34)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る