PT-2015-5122 · Apple · Os X

Lokihardt + 2 · Publicado 2015-04-08 · Atualizado 2019-01-31 · CVE-2015-1140

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.3

Description The issue is related to a buffer overflow in the IOHIDFamily component of Apple OS X, allowing local users to gain privileges. Additionally, there are reports of a heap buffer overflow in the IOHIDSecurePromptClient and an untrusted pointer dereference, which can lead to arbitrary code execution.

Recommendations For versions prior to 10.10.3, update to version 10.10.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the IOHIDFamily component and the IOHIDSecurePromptClient until a patch is applied. Avoid using the affected IOHIDSecurePromptClient function in sensitive operations until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-1140

ZDI-15-121

ZDI-15-165

Produtos afetados

Os X

Referências · 8

• 🔥 https://github.com/kpwn/vpwn · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1140 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html · Aviso do Fabricante
• http://securitytracker.com/id/1032048 · Nota
• http://securityfocus.com/bid/73982 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-121 · Nota de Segurança
• https://support.apple.com/HT204659 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-15-165 · Nota de Segurança