Multiple vulnerabilities in Parallels Desktop



Risk Low
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2020-8871
CVE-2020-8872
CVE-2020-8874
CVE-2020-8873
CVE-2020-8875
CVE-2020-8876
CWE-ID CWE-787
CWE-125
CWE-190
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Parallels Desktop
Operating systems & Components / Operating system package or component

Vendor Parallels

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Out-of-bounds write

EUVDB-ID: #VU26132

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8871

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the VGA virtual device. A local user can trigger out-of-bounds write, execute arbitrary code on the target system and gain elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-292/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU26131

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8872

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the xHCI component. A local user can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-293/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU26130

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8874

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow in the xHCI component. A local user can trigger integer overflow and gain elevated privileges on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-295/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU26129

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8873

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a lack of proper locking when performing operations on an object within the xHCI component. An local user can gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-294/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

EUVDB-ID: #VU26128

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8875

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the IOCTL handler. A local user can trigger out-of-bounds write, execute arbitrary code on the target system and gain elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-296/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU26127

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-8876

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the IOCTL handler. A local user can trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Parallels Desktop: before 15.1.3

CPE2.3 External links

https://www.zerodayinitiative.com/advisories/ZDI-20-297/


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###