PT-2023-4267 · Apple · Apple Macos

Gergely Kalman + 1 · Publicado 2023-07-24 · Atualizado 2024-11-07 · CVE-2023-32364

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS versions prior to 13.5

Description A logic issue was addressed with improved restrictions, allowing a sandboxed process to potentially circumvent sandbox restrictions. This issue is related to errors in security settings of the AppSandbox component in macOS, which may enable an attacker to bypass the protective mechanism of the isolated program environment.

Recommendations For versions prior to 13.5, update to macOS Ventura 13.5 to resolve the issue. As a temporary workaround, consider restricting access to sandboxed processes until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2023-04584

CVE-2023-32364

Produtos afetados

Apple Macos

Referências · 22

• 🔥 https://github.com/gergelykalman/CVE-2023-32364-macos-app-sandbox-escape · Exploit
• https://twitter.com/ptracesecurity/status/1707462704309395570 · Publicação no Twitter
• https://twitter.com/Din3zh/status/1707068698203177307 · Publicação no Twitter
• https://twitter.com/patch1t/status/1854365131804913706 · Publicação no Twitter
• https://support.apple.com/en-us/HT213843 · Aviso do Fabricante
• https://support.apple.com/kb/HT213845 · Aviso do Fabricante
• https://twitter.com/gothburz/status/1707520664440033549 · Publicação no Twitter
• https://support.apple.com/kb/HT213844 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04584 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-32364 · Nota de Segurança
• https://support.apple.com/en-us/HT213844 · Nota
• https://support.apple.com/en-us/120334 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32364 · Nota
• https://twitter.com/gergely_kalman/status/1706683230005362870 · Publicação no Twitter
• https://support.apple.com/en-us/HT213845 · Nota