PT-2017-14624 · Haystack · Arq

M4Rkw + 1 · Publicado 2017-12-01 · Atualizado 2020-06-04 · CVE-2017-16895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arq versions 5.x before 5.10

Description The issue allows local users to gain root privileges via a crafted data packet, affecting several helper apps in Arq, including arq updater, arqcommitter, standardrestorer, arqglacierrestorer, and arqs3glacierrestorer.

Recommendations For Arq versions 5.x before 5.10, update to version 5.10 or later to resolve the issue.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-16895

Produtos afetados

Arq

Referências · 5

• 🔥 https://exploit-db.com/exploits/43216 · Exploit
• https://arqbackup.com/blog/arq-mac-import-security-update · Nota
• https://m4.rkw.io/blog/cve201716895-local-root-privesc-in-arq-backup--597.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16895 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16895 · Aviso do Fabricante