iOS 12.4 - Sandbox Escape due to Integer Overflow in mediaserverd

mediaserverd has various media parsing responsibilities; its reachable from various sandboxes and is able to talk to interesting kernel drivers so is a valid target in an exploit chain. One of the services it vends is com.apple.audio.AudioFileServer, a fairly simple XPC service which will parse...

In-depth exploration found in the wild iOS exploit chain IV-vulnerability warning-the black bar safety net

Overview This exploit chain for iOS 12 – 12.1 version, when we found in the wild exploit of the chain, the two vulnerabilities are no official patch released. So we to an Apple reported two vulnerabilities in the 7 days after the iOS release 12. 1. 4 updated version. Here's the sandbox escape...

In-depth exploration found in the wild iOS exploit chain III-vulnerability warning-the black bar safety net

Overview This article exploits the chain's target is iOS 11-11. 4. 1, spanning nearly 10 months. This is what we observed first having a separate sandbox escape exploits chain. The sandbox escape vulnerability is libxpc in more serious security problem, wherein the reconstruction will lead to a W...

In-the-wild iOS Exploit Chain 4

Posted by Ian Beer, Project Zero TL;DR This exploit chain supported iOS 12-12.1, although the two vulnerabilities were unpatched when we discovered the chain in the wild. It was these two vulnerabilities which we reported to Apple with a 7-day deadline, leading to the release of iOS 12.1.4. The...

In-the-wild iOS Exploit Chain 3

Posted by Ian Beer, Project Zero TL;DR This chain targeted iOS 11-11.4.1, spanning almost 10 months. This is the first chain we observed which had a separate sandbox escape exploit. The sandbox escape vulnerability was a severe security regression in libxpc, where refactoring lead to a bounds che...

CVE-2019-13013

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root...

Privilege escalation

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root...

CVE-2019-13013

CVE-2019-13013 affects Little Snitch versions 4.3.0 to 4.3.2. The vulnerability lies in the privileged helper tool, which exposes an XPC interface accessible to any process and allows directory listings and copying files as root, enabling local privilege escalation. The available connected docume...

CVE-2019-13013

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root...

CVE-2019-13013: Missing Authorization

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root...

PT-2019-13079

Name of the Vulnerable Software and Affected Versions Little Snitch versions 4.3.0 through 4.3.2 Description The issue concerns a local privilege escalation in the privileged helper tool of Little Snitch. This tool implements an XPC interface that is accessible to any process, allowing for...

Privilege escalation

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shel...

CVE-2018-10171

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shel...

CVE-2018-10171

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shel...

PT-2019-8746

Name of the Vulnerable Software and Affected Versions Kromtech MacKeeper version 3.20.4 Description The issue allows an unprivileged application to connect and execute shell scripts as the root user through the com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. This component...

CVE-2018-10171: Incorrect Permission Assignment for Critical Resource

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shel...

iOS 12.1.3 - cfprefsd Memory Corruption Exploit

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. // iOS 12.1.3 - cfprefsd Memory Corruption Exploit include import include include include include include define AGENT 1 define...

iOS 12.1.3 - 'cfprefsd' Memory Corruption

// c 2019 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes // Intended only for educational and defensive purposes only. // Use at your own risk. include import include include include include include define AGENT 1 define FILLDICTCOUNT 0x600 define FILLCOUNT 0x1000 define FREECOU...

0 day: a detailed analysis of the macOS platform Shimo VPN Multiple privilege elevation vulnerability-vulnerability warning-the black bar safety net

One, overview The Cisco Talos team recently disclosed Shimo VPN help tool Helper Tool a series of holes. Shimo VPN is the macOS platform a very popular VPN client that can in one application to connect multiple VPN accounts. These particular vulnerabilities were in the help tool, this is the Shim...

Splitting atoms in XNU

Posted by Ian Beer, Google Project Zero TL;DR A locking bug in the XNU virtual memory subsystem allowed violation of the preconditions required for the correctness of an optimized virtual memory operation. This was abused to create shared memory where it wasn't expected, allowing the creation of ...