SB2021091320 - Remote code execution in Apple macOS Catalina
Published: September 13, 2021 Updated: February 16, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 22 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2021-30860)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when processing PDF files within the CoreGraphics component. A remote attacker can trick the victim to open a specially crafted PDF file, trigger integer overflow and execute arbitrary code on the target system.
Note, the vulnerability is being active exploited in-the-wild via the FORCEDENTRY tool against Bahraini activists.
2) Race condition (CVE-ID: CVE-2020-29622)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a race condition within the OS kernel subsystem when mounting a malicious NFT network share. A remote attacker can trick the victim to mount a specially crafted NFS share, trigger a race condition and execute arbitrary code with system privileges.
3) Resource exhaustion (CVE-ID: CVE-2013-0340)
The vulnerability allows remote attackers to cause a denial of service attack.
The vulnerability exists due to insufficient validation of user-supplied input within the expat library, when processing XML files. A remote attacker can pass specially crafted XML content to the affected library and perform a denial of service (DoS) attack.4) Use of Uninitialized Variable (CVE-ID: CVE-2021-22925)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of uninitialized variable in code, responsible for processing TELNET requests when parsing NEW_ENV variables. A remote attacker can force the affected application to connect to a telnet server under attackers control and read up to 1800 bytes from the uninitialized memory on the libcurl client system.
5) Input validation error (CVE-ID: CVE-2021-30713)
The vulnerability allows a local user to bypass Privacy preferences.
The vulnerability exists due to insufficient validation of user-supplied input within the TCC subsystem. A malicious application can bypass Privacy preferences and gain full disk access, perform screen recording or gain other permissions without requiring user's explicit consent.
Note, the vulnerability is being actively exploited in the wild by XCSSET malware.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-30783)
The vulnerability allows a local application to bypass sandbox restrictions.
The vulnerability exists due to improperly imposed security restrictions within the CoreServices subsystem. A sandboxed process may be able to circumvent sandbox restrictions.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-30827)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improperly imposed security restrictions in CUPS. A local user can execute arbitrary code on the system with elevated privileges.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-30828)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to improperly imposed security restrictions in CUPS subsystem. A local user can read arbitrary files with root privileges.
9) Input validation error (CVE-ID: CVE-2021-30829)
The vulnerability allows a local user to execute arbitrary files with elevated privileges.
The vulnerability exists due to insufficient validation of user-supplied input while parsing URI in CUPS subsystem. A local user can execute arbitrary files on the system.
10) Buffer overflow (CVE-ID: CVE-2021-30830)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the OS kernel subsystem. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with root privileges.
11) Use-after-free (CVE-ID: CVE-2021-30832)
The vulnerability allows a local user to escalate privileges on the system.
12) Buffer overflow (CVE-ID: CVE-2021-30835)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing images within ImageIO. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
13) Buffer overflow (CVE-ID: CVE-2021-30841)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing font files within FontParser. A remote attacker can create a specially crafted document or a web page with a malicious font, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
14) Buffer overflow (CVE-ID: CVE-2021-30842)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing font files within FontParser. A remote attacker can create a specially crafted document or a web page with a malicious font, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
15) Buffer overflow (CVE-ID: CVE-2021-30843)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing font files within FontParser. A remote attacker can create a specially crafted document or a web page with a malicious font, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
16) Memory leak (CVE-ID: CVE-2021-30844)
The vulnerability allows a local user to perform DoS attack.
The vulnerability exists due memory leak within the SMB subsystem. A local user can force the application to leak memory and perform denial of service attack.
17) Buffer overflow (CVE-ID: CVE-2021-30847)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing images within ImageIO. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-30850)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists within the Sandbox subsystem. A local user can gain access to protected parts of the file system.
19) UNIX symbolic link following (CVE-ID: CVE-2021-30855)
The vulnerability allows a local application to gain access to otherwise restricted functionality.
The vulnerability exists due to a symlink following issue in Preferences. A local application can create a specially crafted symbolic link to a critical file on the system and access restricted files.
20) Race condition (CVE-ID: CVE-2021-30857)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition with the OS kernel component. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
21) Type Confusion (CVE-ID: CVE-2021-30859)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a type confusion error within the OS kernel subsystem. A local user can run a specially crafted application to trigger a type confusion error and execute arbitrary code with kernel privileges.
22) Out-of-bounds read (CVE-ID: CVE-2021-30865)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary condition within the OS kernel subsystem. A local user can trigger an out-of-bounds read error and execute arbitrary code with kernel privileges.
Remediation
Install update from vendor's website.