macos_xprotect

macOS XProtect 入門 macOS 入門ブログシリーズの続きとして、XProtect に短いブログ投稿を割り当てることにしました。 XProtect とは? XProtect は、macOS に組み込まれている Apple のウイルス対策・マルウェアシグネチャシステムです。 これは XProtectService の一部として動作し、アプリケーションやその他の実行可能コンテンツを既知のマルウェアシグネチャと照合してスキャンします。 XProtect はバックグラウンドで動作し、Apple が XProtectRemediator メカニズムを通じて静かに更新します（詳細は後述...

XPRTestSuite

XProtect Remediator テストスイート 将来の XProtect Remediator XPR 研究に役立つスクリプトとドキュメントのコレクションです。Black Hat USA 2025 で発表されました。 このリポジトリについて このリポジトリには以下が含まれます: XPR の各スキャンモジュールの修復を再現する、無害な最小限のファイルとプロセスを作成するスクリプト RemediationBuilder DSL を用いて、リバースエンジニアリングした XPR の修復（または検出）ロジックを説明するドキュメント これらのスクリプトとドキュメントは、XPR...

Ph-n-t-ch-CVE-2024-40842-XProtectRemediatorDubRobber-Information-Leak-tr-n-macOS

CVE-2024-40842: macOSにおけるXProtectRemediatorDubRobberの情報漏洩 概要 CVE-2024-40842 は、macOSの XProtect Remediator におけるローカル情報漏洩の脆弱性であり、以下のモジュールに関連しています: XProtectRemediatorDubRobber 本脆弱性は、Appleの特権セキュリティプロセスが環境変数 MAGIC を安全に処理しないことに起因します。 マシン上で実行中の悪意のあるアプリケーションは、この動作を悪用して、通常アクセス権のないデータをXProtectに読み込ませることが可能です。...

CVE-2026-3014

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

EUVD-2026-43655

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

CVE-2026-3014 Remote Code Execution by administrative user on the Management Server

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

CVE-2026-3014

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

CVE-2026-3014

CVE-2026-3014 concerns Milestone XProtect. A vulnerability in the Management Server API could allow users with edit permissions on the Management Server to execute arbitrary code in the context of the Management Server Service. Milestone has released a new version of XProtect with cumulative patc...

PT-2026-58002

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

CVE-2026-3014: Improper Neutralization of Special Elements used in an OS Command

Milestone has released a new version of XProtect® and several cumulative patch updates which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server...

CVE-2026-33631

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

CVE-2026-33631

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

CVE-2026-33631

CVE-2026-33631 affects ClearanceKit on macOS. In the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy only for ES_EVENT_TYPE_AUTH_OPEN; seven additional file operation events were not intercepted, allowing local processes to bypass FAA policy wit...

CVE-2026-33631 ClearanceKit: opfilter policy bypass via non-open file operations

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

EUVD-2026-16371

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

CVE-2026-33631 ClearanceKit: opfilter policy bypass via non-open file operations

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

CVE-2026-33631

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

CVE-2026-33631 ClearanceKit: opfilter policy bypass via non-open file operations

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ESEVENTTYPEAUTHOPEN events. Seven additional file...

PT-2026-28500

Name of the Vulnerable Software and Affected Versions ClearanceKit versions 4.1 and earlier Description ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension...

CVE-2025-0836

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API...