Executive brief
A security flaw in early versions of the NeXTstep operating system allows a default user account to gain full administrative control. By design, the 'me' user was granted special group privileges that allow it to bypass standard security restrictions. An individual with access to this account could take over the entire system, potentially accessing, modifying, or deleting any data on the machine.
Technical details
In NeXT NeXTstep versions 2.1 and earlier, the default 'me' user account is a member of the 'wheel' group. In Unix-like systems, membership in the 'wheel' group typically grants the permission to use the 'su' (substitute user) command to escalate privileges to the superuser (root) account. An attacker or unauthorized user logged into the 'me' account can exploit this configuration to gain full root access to the operating system. This is a privilege escalation vulnerability resulting from insecure default group assignments. Users are advised to remove the 'me' user from the 'wheel' group or upgrade to a version where this default configuration has been remediated.
Affected products
- NeXT NeXTstep 2.1 and earlier
Timeline
- 1991-05-14: disclosed: Initial publication date
- 1991-05-14: advisory: NVD published date