PT-2019-8746 · Kromtech · Mackeeper

Publicado 2019-06-05 · Atualizado 2020-08-24 · CVE-2018-10171

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kromtech MacKeeper version 3.20.4

Description The issue allows an unprivileged application to connect and execute shell scripts as the root user through the com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. This component implements an XPC service, enabling the execution of shell scripts with root privileges.

Recommendations For Kromtech MacKeeper version 3.20.4, consider disabling the com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-10171

Produtos afetados

Mackeeper

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-10171 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10171 · Aviso do Fabricante
• https://t.me/cibsecurity/4718 · Publicação no Telegram
• https://versprite.com/advisories/mackeeper · Nota