Sandbox Escape: OSX ATS memory corruption may lead to App Sandbox bypass

2014-02-2600:00:00

Unknown

hackerone.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

64.6%

JSON

This issue was reported directly to Apple and has been resolved in OSX Security Update 2014-001.

http://support.apple.com/kb/HT6150

> Available for: OS X Mavericks 10.9 and 10.9.1
>
> Impact: The App Sandbox may be bypassed
>
> Description: A memory corruption issue existed in the handling of Mach messages passed to ATS. This issue was addressed through improved bounds checking.
>
> CVE-2014-1262 : Meder Kydyraliev of the Google Security Team