Security: Get root on an OS X 10.10 Mac: The exploit is so trivial it fits in a tweet

[You are the One]

Haven't heard any noise about this so I'll post it.

I'm on El Cap beta so I don't see any security patches for Yosemite.

 

[jasnw]

Here's a link to the full exploit description:

https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html

 

[Partron22]

I'll just sign off the internet now.
Send me a postcard, postage due, when it's safe to come back online.

Why is it I get asked for a password when I want to move a file into my utilities folder, when any jerk on the network can circumvent the password system completely and do as they will with my Mac?
This security theatre regime with its sandboxing and code signatures and limiting of where we can download apps from becomes more ludicrous with each passing day.

 

[Kornelis]

First they need to get in your system to use this exploit....

http://www.imore.com/dyldprinttofile-exploit-what-you-need-know

 

[You are the One]

That is done in a Flash.

 

[2984839]

That is done in a Flash.

Yep.

Or in the case of many universities, just by walking up to the room full of iMacs and picking one.

edit: Though those at my university are running Mavericks, but the point remains. Local privilege escalations are a huge problem.