PT-2018-5594

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13 Description: The issue involves the kext tools component, allowing attackers to execute arbitrary code in a privileged context via a crafted app that performs kext loading. Recommendations: For macOS versions pri...

PT-2018-16428

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.4 Description The issue involves the kext tools component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app. Recommendations Fo...

CVE-2018-4139: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

macOS 10.13.x < 10.13.4 Multiple Vulnerabilities

The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.4. It is, therefore, affected by multiple vulnerabilities in the following components : - Admin Framework - APFS - ATS - CoreFoundation - CoreText - Disk Images - Disk Management - File System Events - iCloud...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-002)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - ATS - CFNetwork Session - CoreFoundation - CoreTypes - curl - Disk Images - iCloud Drive - Kernel - kext...

Proxifier for Mac 2.19 - Local Privilege Escalation

With CVE-2017-7643 I disclosed a command injection vulnerablity in the KLoader binary that ships with Proxifier = 2.18. Unfortunately 2.19 is also vulnerable to a slightly different attack that yields the same result. When Proxifier is first run, if the KLoader binary is not suid root it gets...

kext tools Privilege Escalation

The vulnerability of the Mac OS X operating system’s kext tools arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in privileged context or trigger a service failure memory corruption through ...

Security research team released 8 Apple iOS security vulnerability: hackers can easily attack-vulnerability warning-the black bar safety net

According to foreign media ZDNet reports, the Israeli mobile security company Zimperium recently released 8 Apple iOS system vulnerabilities, hackers can exploit these vulnerabilities to completely control the user's iOS device, so as to obtain the device's GPS data, photos, and contact...

Apple macOS Sierra kext tools component memory corruption vulnerability

Apple macOS Sierra is a specialized operating system developed by Apple for Mac computers. kext tools is one of the components for system driver installation and privilege repair. A memory corruption vulnerability exists in the kext tools component in Apple macOS Sierra versions prior to 10.12.6...

CVE-2017-7032

An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2017-7032

An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2017-7032

CVE-2017-7032 affects the kext tools component in macOS Sierra 10.12.x prior to 10.12.6. Root cause: memory corruption due to improper input validation. Impact: arbitrary code execution with system privileges or denial of service when a crafted app is opened. Apple patched in macOS 10.12.6 / Secu...

CVE-2017-7032

An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

PT-2017-2525

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.12.6 Description The issue involves the kext tools component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app. This is caused by ...

CVE-2017-7032: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "kext tools" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2017-4918: VMware Horizon macOS client code injection vulnerability analysis-vulnerability warning-the black bar safety net

This article I want to discuss under the VMware Horizon macOS client version 4. 4. 0, the 5164329 of a code injection vulnerability, which can be used to obtain local root privileges. The good news is this issue already in the latest version is fix. 0x01 analysis On my MAC the above understanding...

InsomniaX 2.1.8 Arbitrary Kernel Extension Loading Vulnerability

It was found that the loader application bundled with InsomniaX can be used to load arbitrary Kernel Extensions kext. The loader is normally used to load a kext file that is needed to disable the Lid Sleep. A flaw has been found in the loader that allows a local attacker to load or unload any...

InsomniaX 2.1.8 Arbitrary Kernel Extension Loading

------------------------------------------------------------------------ InsomniaX loader allows loading of arbitrary Kernel Extensions ------------------------------------------------------------------------ Yorick Koster, April 2017...

Proxifier for Mac 2.18 - Multiple Vulnerabilities

Exploit for macOS platform in category local exploits Source: https://www.securify.nl/advisory/SFY20170401/multiplelocalprivilegeescalationvulnerabilitiesinproxifierformac.html Abstract Multiple local privileges escalation vulnerabilities were found in the KLoader binary that ships with Proxifier...

Introducing Monitor.app for macOS

As a malware analyst or systems programmer, having a suite of solid dynamic analysis tools is vital to being quick and effective. These tools enable us to understand malware capabilities and undocumented components of the operating system. One obvious tool that comes to mind is Procmon from the...