PT-2020-6093 · Apple · Apple Macos

Andy Grant + 2 · Published 2020-05-26 · Updated 2022-06-02 · CVE-2020-9817

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.15.5

Description A permissions issue existed, allowing a malicious application to potentially gain root privileges due to errors in standard permission usage. This issue was addressed with improved permission validation.

Recommendations For versions prior to 10.15.5, update to macOS Catalina 10.15.5 to resolve the issue. As a temporary workaround, consider restricting the execution of malicious applications to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2021-02984

CVE-2020-9817

Affected Products

Apple Macos

References · 8

• https://osv.dev/vulnerability/CVE-2020-9817 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-mac-priv-esc-VqST2nrT · Vendor Advisory
• https://support.apple.com/HT211170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9817 · Security Note
• https://bdu.fstec.ru/vul/2021-02984 · Security Note
• https://t.me/defcon_news/51203 · Telegram Post
• https://t.me/secharvester/9449 · Telegram Post
• https://t.me/rnetsec/12728 · Telegram Post