Privilege escalation in CoreCode MacUpdater



Published: 2023-09-26
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-41902
CWE-ID CWE-264
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		MacUpdater
Client/Desktop applications / Other client software

Vendor corecode (Simon Schubert)

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU81123

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-41902

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an XPC misconfiguration issue. A local user can use a specially crafted .pkg file and gain elevated privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MacUpdater: 2.0.0 - 3.1.2

Fixed software versions

CPE2.3 External links

http://www.corecode.io/macupdater/history2.html
http://www.corecode.io/macupdater/history3.html
http://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###