PT-2017-14624 · Haystack · Arq

M4Rkw + 1 · Published 2017-12-01 · Updated 2020-06-04 · CVE-2017-16895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arq versions 5.x before 5.10

Description The issue allows local users to gain root privileges via a crafted data packet, affecting several helper apps in Arq, including arq updater, arqcommitter, standardrestorer, arqglacierrestorer, and arqs3glacierrestorer.

Recommendations For Arq versions 5.x before 5.10, update to version 5.10 or later to resolve the issue.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-16895

Affected Products

Arq

References · 5

• 🔥 https://exploit-db.com/exploits/43216 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16895 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16895 · Vendor Advisory
• https://arqbackup.com/blog/arq-mac-import-security-update · Note
• https://m4.rkw.io/blog/cve201716895-local-root-privesc-in-arq-backup--597.html · Note