PT-2020-14953 · Parallels · Parallels Desktop

Singi@Theori · Published 2020-08-18 · Updated 2020-10-09 · CVE-2020-17402

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Parallels Desktop version 15.1.4

Description This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the prl hypervisor kext. By examining a log file, an attacker can disclose a memory address. This can be leveraged in conjunction with other issues to escalate privileges and execute code in the context of the kernel.

Recommendations For Parallels Desktop version 15.1.4, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Permission

Buffer Overflow

Weakness Enumeration

CWE-732

CWE-120

Related Identifiers

BDU:2020-05759

CVE-2020-17402

ZDI-20-1020

Affected Products

Parallels Desktop

References · 14

• https://kb.parallels.com/en/125013 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17402 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17402 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05759 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1020 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17402 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-17402 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://github.com/Exiv2/exiv2/issues/1019 · Note
• https://access.redhat.com/security/cve/cve-2020-17402 · Note
• https://suse.com/security/cve/CVE-2019-17402 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.3 · Note