CVE:CVE-2006-6131
CNNVD:CNNVD-200611-443
Kerio WebSTAR是运行在Mac OS X平台上的WEB服务器。
Kerio WebSTAR在不安全的权限安装程序文件，本地攻击者可能利用此提升自己的权限。
在安装Kerio WebSTAR时/Applications中继承了两个setuid二进制程序：
 kevin-finisterres-computer:~/Desktop kf$ find /Applications/Kerio\ WebSTAR -perm -4000 -ls
978790 3016 -rwsrwx--x    1 root     admin     1542556 Apr 10  2006 /Applications/Kerio WebSTAR/AdminServer/WSAdminServer
979475 3288 -rwsrwx---    1 root     admin     1679724 Apr 10  2006 /Applications/Kerio WebSTAR/WebServer/WSWebServer
如果攻击者能够访问webstar用户或admin组的话，就可以通过滥用上述两个二进制程序以root用户权限执行代码。这两个二进制程序都试图加载当前目录中的帮助程序库，因此攻击者可以通过提供已植入了木马的应用程序来利用这个漏洞。
kevin-finisterres-computer:~ kf$ /Applications/Kerio\ WebSTAR/WebServer/WSWebServer
dyld: Library not loaded: libucache.dylib
  Referenced from: /Applications/Kerio WebSTAR/WebServer/WSWebServer
  Reason: image not found
Trace/BPT trap
kevin-finisterres-computer:~ kf$ /Applications/Kerio\ WebSTAR/AdminServer/WSAdminServer  
dyld: Library not loaded: libucache.dylib
  Referenced from: /Applications/Kerio WebSTAR/AdminServer/WSAdminServer
  Reason: image not found
Trace/BPT trap
ktrace可以更清楚的说明这个漏洞： 
  1183 WSAdminServer CALL  open(0x17e8,0,0)
  1183 WSAdminServer NAMI  "libucache.dylib"
  1183 WSAdminServer RET   open -1 errno 2 No such file or directory
  1183 WSAdminServer CALL  close(0xffffffff)
...
  1183 WSAdminServer CALL  open(0xbfffea90,0,0)
  1183 WSAdminServer NAMI  "/var/root/lib/libucache.dylib"
  1183 WSAdminServer RET   open -1 errno 2 No such file or directory
  1183 WSAdminServer CALL  close(0xffffffff)
  1183 WSAdminServer RET   close -1 errno 9 Bad file descriptor
  1183 WSAdminServer CALL  open(0xbfffea90,0,0)
  1183 WSAdminServer NAMI  "/usr/local/lib/libucache.dylib"
  1183 WSAdminServer RET   open -1 errno 2 No such file or directory
  1183 WSAdminServer CALL  close(0xffffffff)
  1183 WSAdminServer RET   close -1 errno 9 Bad file descriptor
  1183 WSAdminServer CALL  open(0xbfffeaa0,0,0)
  1183 WSAdminServer NAMI  "/usr/lib/libucache.dylib"
  1183 WSAdminServer RET   open -1 errno 2 No such file or directory
  1183 WSAdminServer CALL  close(0xffffffff)
solution:Upgrade kerio webstar to a higher version than 5.4.2,4.0,5.1.2,5.1.3,5.2,5.2.1,5.2.2,5.2.3,5.2.4,5.3,5.3.1,5.3.2,5.3.3,5.3.4,5.4,and avoid the version (,5.4.2],4.0,5.1.2,5.1.3,5.2,5.2.1,5.2.2,5.2.3,5.2.4,5.3,5.3.1,5.3.2,5.3.3,5.3.4,5.4