Intego Announces a New Apple Remote Desktop Vulnerability

Intego reports to has identified a new vulnerability in Mac OS X 10.4 and 10.5 which is linked to the application Apple Remote Desktop. According to Intego, the ARD vulnerability would allow malicious programs to execute code as Root without requiring a password:

A vulnerability has been discovered that allows malicious programs to execute code as root when run locally, or via a remote connection, on computers running Mac OS X 10.4 and 10.5. This vulnerability takes advantage of the fact that ARDAgent, a part of the Remote Management component of Mac OS X 10.4 and 10.5, has a setuid bit set. Any user running such an executable gains the privileges of the user who owns that executable. In this case, ARDAgent is owned by root, so running code via the ARDAgent executable runs this code as root, without requiring a password. The exploit in question depends on ARDAgent’s ability to run AppleScripts, which may, in turn, include shell script commands.
When an application enables a root privilege escalation of this type, any malicious code that is run may have devastating effects. These may range from deleting all the files on the Mac (regardless of who owns them) to more pernicious attacks such as changing system settings, and even setting up periodic tasks to perform them repeatedly. Any application could use this vulnerability to obtain root privileges without users ever needing to enter passwords. Users could run malicious programs that they download from the Internet or receive from friends or colleagues, and, if the program exploits this vulnerability, simply launching it once would be sufficient for damage to be done.
There are cases where this exploit does not work. If a user has turned on Remote Management in the Sharing pane of System Preferences under Mac OS X 10.5, or if a user has installed Apple Remote Desktop client under Mac OS X 10.4 or earlier and has activated this setting in the Sharing preferences, the exploit will not function. Most users, however, will not have this service turned on; generally only those users who want to observe or control other computers on their network will turn this on to do so. Note that Mac OS X 10.5’s Screen Sharing function has no effect on this vulnerability.
This exploit can be triggered by any type of user account: standard user, administrator, or even a guest account. Therefore, a guest logged in using Mac OS X 10.5’s Guest Account feature has the ability to download an application and unwittingly run malicious code with no security warning.

Thanks to SecureMac we know a bit about this vulnerability. The code was initially mentioned by Slashdot after being reported on a forum. With a simple AppleScript ran on a Mac you can launch any command line with root rights without requiring the administrator password.
Even more dangerous, a Trojan, named AppleScript.THT, has been created, once run by the users (administrator or not), it can take screenshot from your iSight, record your keyboard entries, execute any codes, send password to a remote server, etc. it can even manage to protect itself by deactivating system message recording and opening ports on your firewall.
The file NOT to be launched is currently named ASthtv05 or AStht_v06. This Trojan is currently detected by MacScan and VirusBarrier X5 with their last virus definitions.