PT-2023-25855 · Parsec+1 · Parsec Loader+1

Julian Horoszkiewicz · Publicado 2023-08-20 · Atualizado 2024-10-17 · CVE-2023-37250

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unity Parsec versions prior to 9 Parsec Loader versions prior to 9

Description The issue is a Time-of-check-to-time-of-use (TOCTOU) race condition that allows local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs.

Recommendations For Unity Parsec versions prior to 9, update to version 9 to resolve the issue. For Parsec Loader versions prior to 9, update to version 9 to resolve the issue. As a temporary workaround, consider restricting access to the user-owned directory where the DLLs are launched to minimize the risk of exploitation.

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

CVE-2023-37250

Produtos afetados

Parsec Loader

Unity Parsec

Referências · 7

• https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250 · Nota
• https://twitter.com/SteveKWork1318/status/1846875718254256477 · Publicação no Twitter
• https://unity3d.com · Nota
• https://t.me/cvenotify/56945 · Publicação no Telegram
• https://kb.cert.org/vuls/id/287122 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37250 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37250 · Aviso do Fabricante