0 day: a detailed analysis of the macOS platform Shimo VPN Multiple privilege elevation vulnerability-vulnerability warning-the black bar safety net

One, overview The Cisco Talos team recently disclosed Shimo VPN help tool Helper Tool a series of holes. Shimo VPN is the macOS platform a very popular VPN client that can in one application to connect multiple VPN accounts. These particular vulnerabilities were in the help tool, this is the Shim...

Vulnerability Spotlight: Multiple vulnerabilities in Shimo VPN's helper tool

Discovered by Tyler Bohan of Cisco Talos. Overview Cisco Talos is disclosing a series of vulnerabilities found in the Shimo VPN Helper Tool. Shimo VPN is a popular VPN client for MacOS that can be used to connect multiple VPN accounts to one application. These specific vulnerabilities were found ...

Shimo VPN helper tool configureRoutingWithCommand privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine for a...

CVE-2018-4052

An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user...

Information disclosure

An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user...

CVE-2018-4053

An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can send malicious data to the root-listening service, causing the application to terminate and become unavailable...

GOG Galaxy Games fillProcessInformationForPids information leak vulnerability

Summary An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy’s Games, version 1.2.47 for macOS. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user. Tested Versions Gog Galaxy...

CVE-2018-4055

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to successful...

CVE-2018-4054

A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to successfully...

Vulnerability Spotlight: Multiple local vulnerabilities in Pixar Renderman

Tyler Bohan of Cisco Talos discovered these vulnerabilities. Executive summary The MacOS version of Pixar Renderman contains three local vulnerabilities in its install helper tool. An attacker could exploit these bugs to escalate their privileges to root. Renderman is a rendering application used...

NordVPN Root Elevation of Privilege Vulnerability

NordVPN is a virtual private network tool that gives you a high-speed and stable connection to the world wide web and secure access to a wide range of streaming sites, censored content and social media. NordVPN 3.3.10 for macOS suffers from a root elevation of privilege vulnerability. An attacker...

Privilege escalation

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately...

CVE-2018-9105

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately...

VPN Unlimited for macOS privileged helper tool privilege access control vulnerability

VPN Unlimited for macOS is a VPN application based on macOS platform. privileged helper tool is one of the helper tools. A privilege access control vulnerability exists in the privileged helper tool in version 4.2.0 of VPN Unlimited for macOS. An attacker can use this vulnerability to execute...

CVE-2018-8739

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

CVE-2018-8739

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

CactusVPN root elevation of privilege vulnerability

CactusVPN for macOS is a macOS-based VPN software from CactusVPN Moldova for anonymous access to the Internet. privileged helper tool is one of the helper tools. A privileged helper tool vulnerability exists in CactusVPN 6.0 and earlier versions for macOS-based platforms. An attacker can exploit...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

Apple XCode 4.x 信息泄露漏洞

BUGTRAQ ID: 54679 CVE ID: CVE-2012-3698,CVE-2011-3389 Xcode是苹果机器上所使用的开发工具。 Apple Xcode 4.4之前版本在实现上存在安全漏洞，可被恶意用户利用泄露敏感信息，劫持用户会话，绕过某些安全限制。 1） SSL 3.0和TLS 1.0协议的实现中存在设计错误。 2） DR实现中的错误可允许App Store应用访问用Xcode构建的Helper工具中的密钥链项目。 0 Apple XCode 4.x 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Fedora Update for cobbler FEDORA-2008-10000

Check for the Version of cobbler OpenVAS Vulnerability Test Fedora Update for cobbler FEDORA-2008-10000 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...