Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the \publish Bash shell scripts\ feature to insert \/Applications/Utilities/Terminal app/Contents/MacOS/Terminal\ into the TCP data stream.