PT-2023-25855 · Parsec+1 · Parsec Loader+1

Julian Horoszkiewicz · Published 2023-08-20 · Updated 2024-10-17 · CVE-2023-37250

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unity Parsec versions prior to 9 Parsec Loader versions prior to 9

Description The issue is a Time-of-check-to-time-of-use (TOCTOU) race condition that allows local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs.

Recommendations For Unity Parsec versions prior to 9, update to version 9 to resolve the issue. For Parsec Loader versions prior to 9, update to version 9 to resolve the issue. As a temporary workaround, consider restricting access to the user-owned directory where the DLLs are launched to minimize the risk of exploitation.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2023-37250

Affected Products

Parsec Loader

Unity Parsec

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-37250 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37250 · Vendor Advisory
• https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250 · Note
• https://twitter.com/SteveKWork1318/status/1846875718254256477 · Twitter Post
• https://unity3d.com · Note
• https://t.me/cvenotify/56945 · Telegram Post
• https://kb.cert.org/vuls/id/287122 · Note