PT-2023-8362 · Apple · Apple Macos

Csaba Fitzl + 1 · Published 2023-10-25 · Updated 2023-11-02 · CVE-2023-40425

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.7.1

Description A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app with root privileges to access private information. The vulnerability is related to insufficient protection of registration data in the macOS Sandbox component, which could allow an attacker to disclose protected information.

Recommendations For versions prior to 12.7.1, update to macOS Monterey 12.7.1 to resolve the issue. As a temporary workaround, consider restricting access to log entries and private data for apps with root privileges until the update is applied.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-00551

CVE-2023-40425

Affected Products

Apple Macos

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-40425 · Security Note
• https://bdu.fstec.ru/vul/2024-00551 · Security Note
• https://support.apple.com/en-us/HT213983 · Vendor Advisory
• https://support.apple.com/kb/HT213983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40425 · Vendor Advisory
• https://support.apple.com/en-us/109055 · Note
• https://t.me/cvenotify/60379 · Telegram Post
• https://support.apple.com/en-us/120950 · Note
• http://seclists.org/fulldisclosure/2023/Oct/21 · Note