SB2019010702 - Multiple vulnerabilities in MacPaw CleanMyMac X

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019010702

SB2019010702 - Multiple vulnerabilities in MacPaw CleanMyMac X

Published: January 7, 2019 Updated: February 18, 2019

Security Bulletin ID SB2019010702
Severity
Low
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 secuirty vulnerabilities.


1) Privilege escalation (CVE-ID: CVE-2018-4032)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `moveItemAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

2) Privilege escalation (CVE-ID: CVE-2018-4033)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `moveToTrashItemAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

3) Privilege escalation (CVE-ID: CVE-2018-4034)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removeItemAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

4) Privilege escalation (CVE-ID: CVE-2018-4035)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `truncateFileAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

5) Privilege escalation (CVE-ID: CVE-2018-4036)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removeKextAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

6) Privilege escalation (CVE-ID: CVE-2018-4041)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `enableLaunchdAgentAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

7) Privilege escalation (CVE-ID: CVE-2018-4042)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removeLaunchdAgentAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

8) Privilege escalation (CVE-ID: CVE-2018-4043)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removeASL` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

9) Privilege escalation (CVE-ID: CVE-2018-4044)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removePackageWithID` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

10) Privilege escalation (CVE-ID: CVE-2018-4045)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `securelyRemoveItemAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

11) Privilege escalation (CVE-ID: CVE-2018-4046)

The vulnerability allows a local unauthenticated attacker to cause DoS condition.

The weakness exists in the `pleaseTerminate` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can terminate a privileged helper application.

12) Privilege escalation (CVE-ID: CVE-2018-4047)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `disableLaunchdAgentAtPath` function of the helper protocol due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

13) Privilege escalation (CVE-ID: CVE-2018-4037)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges.

The weakness exists in the `removeDiagnosticLogs` function due to insufficient validation of user-supplied input. A local attacker can gain elevated privileges and modify the file system as root.

Remediation

Install update from vendor's website.

References