PT-2018-17486 · Facebook · Osquery

Josh Pitts · Published 2018-12-31 · Updated 2025-05-06 · CVE-2018-6336

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions osquery versions prior to 3.2.7

Description A maliciously crafted Universal/fat binary can evade third-party code signing checks in osquery, allowing unsigned code to execute. This occurs because the full inspection of the Universal/fat binary is not completed, leading the user of the third-party tool to believe the code is signed by Apple.

Recommendations For osquery versions prior to 3.2.7, update to version 3.2.7 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-354

CWE-254

Related Identifiers

CVE-2018-6336

Affected Products

Osquery

References · 4

• 🔥 https://okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks · Exploit
• https://osv.dev/vulnerability/CVE-2018-6336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6336 · Security Note
• https://t.me/cvenotify/121088 · Telegram Post