[原文]Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows local users to gain sensitive information by running listing processes.
Cocktail Process List Administrator Password Disclosure
Local Access Required
Loss of Confidentiality
Cocktail contains a flaw that may lead to an unauthorized password exposure. It is possible to gain access to plaintext passwords when cocktail passes the password in cleartext while executing functions, which may lead to a loss of confidentiality.
Upgrade to version 3.6 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
Discovered by sonderling <email@example.com>.
Cocktail Cocktail 3.5.4
Cocktail pipes the computer's Admin password to command line utilities in an insecure manner allowing potential disclosure of the password.
This issue was reported to affect Cocktail 3.5.4. Other versions are likely vulnerable.
No exploit is required.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: firstname.lastname@example.org <mailto:email@example.com>.