PT-2023-8362 · Apple · Apple Macos

Csaba Fitzl + 1 · Publicado 2023-10-25 · Atualizado 2023-11-02 · CVE-2023-40425

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.7.1

Description A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app with root privileges to access private information. The vulnerability is related to insufficient protection of registration data in the macOS Sandbox component, which could allow an attacker to disclose protected information.

Recommendations For versions prior to 12.7.1, update to macOS Monterey 12.7.1 to resolve the issue. As a temporary workaround, consider restricting access to log entries and private data for apps with root privileges until the update is applied.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2024-00551

CVE-2023-40425

Produtos afetados

Apple Macos

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-40425 · Nota de Segurança
• https://support.apple.com/en-us/109055 · Nota
• https://bdu.fstec.ru/vul/2024-00551 · Nota de Segurança
• https://support.apple.com/en-us/HT213983 · Aviso do Fabricante
• https://t.me/cvenotify/60379 · Publicação no Telegram
• https://support.apple.com/kb/HT213983 · Aviso do Fabricante
• https://support.apple.com/en-us/120950 · Nota
• https://osv.dev/vulnerability/CVE-2023-40425 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2023/Oct/21 · Nota