The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Link | Tags |
|---|---|
| https://support.apple.com/HT204659 | vendor advisory |
| http://www.securityfocus.com/bid/73982 | exploit vdb entry third party advisory |
| http://www.osvdb.org/120418 | vdb entry broken link |
| https://www.exploit-db.com/exploits/36692/ | exploit vdb entry third party advisory |
| http://www.securitytracker.com/id/1032048 | vdb entry third party advisory broken link |
| http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html | mailing list vendor advisory |