PT-2020-16839 · Apple · Macos Mojave+3

Thijs Alkemade · Published 2020-11-12 · Updated 2021-04-07 · CVE-2020-27901

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions macOS Big Sur versions prior to 11.1 Security Update 2020-001 Catalina (affected versions not specified) Security Update 2020-007 Mojave (affected versions not specified)

Description A logic issue was addressed with improved restrictions, allowing a sandboxed process to potentially circumvent sandbox restrictions.

Recommendations For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1 or later. For Security Update 2020-001 Catalina, apply Security Update 2020-001 or later. For Security Update 2020-007 Mojave, apply Security Update 2020-007 or later. As a temporary workaround, consider restricting the functionality of sandboxed processes until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-27901

Affected Products

Apple Macos

Macos Big Sur

Macos Catalina

Macos Mojave

References · 8

• https://support.apple.com/en-us/HT211931 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27901 · Vendor Advisory
• https://support.apple.com/en-us/HT212011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27901 · Security Note
• https://support.apple.com/en-us/102846 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27901 · Note
• https://t.me/cvenotify/12846 · Telegram Post
• https://support.apple.com/en-us/103052 · Note