:: Deepquest ::

Cocktail needs administrative privileges the user is
prompted for the admin password upon startup. The actual
maintenance is done by command line utilities that are executed
in an insecure manner: Cocktail creates a new process and
lets /bin/sh pipe the admin password using echo into sudo,
which then will execute the utility, like this:

sh -c echo ‘PASSWORD’ | sudo -p “” -S sudo update_prebinding -root /

Exploitation:

Knowing Cocktail is waiting for some Unix utility to have finished its work, just execute “ps ax” on the terminal and search for the password.

The vendor has been contacted; the new version 3.6 for Mac OS X “Tiger” should have been fixed. I haven’t tested this version, though.

by sonderling