SB2021092711 - Multiple vulnerabilities in Parallels Desktop

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Uncontrolled Memory Allocation (CVE-ID: CVE-2021-34868)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to uncontrolled memory allocation within the Toolgate component. A local user can escalate privileges and execute arbitrary code in the context of the hypervisor.

2) Uncontrolled Memory Allocation (CVE-ID: CVE-2021-34867)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to uncontrolled memory allocation within the Toolgate component. A local administrator can escalate privileges and execute arbitrary code in the context of the hypervisor.

3) Uncontrolled Memory Allocation (CVE-ID: CVE-2021-34869)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to uncontrolled memory allocation within the Toolgate component. A local user can escalate privileges and execute arbitrary code in the context of the hypervisor.

Remediation

Install update from vendor's website.

References

• https://www.zerodayinitiative.com/advisories/ZDI-21-1056/
• https://kb.parallels.com/125013
• https://www.zerodayinitiative.com/advisories/ZDI-21-1055/
• https://www.zerodayinitiative.com/advisories/ZDI-21-1057/