Therefore, non-root users could delete files from the root file system.”Ī second vulnerability, CVE-2018-4033, exists in the “moveToTrashItemAtPath” function. This allows the application to remove and modify system files.”Īs such, the helper functions run as root functions the flaws arise from the act that they can be accessed by applications without validation – thus giving those applications root access.ĬVE-2018-4032 for instance has to do with the “moveItemAtPath” function, according to the advisory: “If the attacker supplies `nil` in the to_path argument, the file is deleted, and any application can access this function and run it as root.
CLEANMYMAC X HELPER TOOL SOFTWARE
The software utilizes a privilege helper tool running as root to get this work done faster. “The application also markets the ability to help detect and prevent viruses and malware on OS X.
“The application is able to scan the system and user directories, looking for unused and leftover files and applications,” explained Cisco in the advisory, issued Wednesday. No fewer than a dozen flaws plague 4.0 earlier versions of the software, all of them in the package’s “helper protocol.” A passel of privilege-escalation vulnerabilities in MacPaw’s CleanMyMac X software would allow a local attacker to gain root access to an Apple machine in various ways.ĬleanMyMac X is a cleanup application for MacOS that optimizes the drives and frees up space by scanning for unused, redundant or unnecessary files and deleting them.
0 kommentar(er)
