PT-2023-16658 · Trellix · Ta

Adam Scheblein · Published 2023-06-07 · Updated 2023-06-13 · CVE-2023-0976

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TA for mac-OS versions prior to 5.7.9

Description A command injection issue allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ folder. The malicious file is executed by running the TA deployment feature located in the System Tree.

Recommendations For versions prior to 5.7.9, update to version 5.7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the TA deployment feature in the System Tree to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2023-0976

Affected Products

Ta

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-0976 · Security Note
• https://kcm.trellix.com/corporate/index?page=content&id=SB10398 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0976 · Vendor Advisory
• https://t.me/cvenotify/52000 · Telegram Post