Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
BID:73982
Info
Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
| Bugtraq ID: | 73982 |
| Class: | Unknown |
| CVE: |
CVE-2015-1131 CVE-2015-1132 CVE-2015-1133 CVE-2015-1134 CVE-2015-1136 CVE-2015-1137 CVE-2015-1138 CVE-2015-1139 CVE-2015-1140 CVE-2015-1141 CVE-2015-1142 CVE-2015-1143 CVE-2015-1144 CVE-2015-1145 CVE-2015-1146 CVE-2015-1147 CVE-2015-1148 CVE-2015-1135 CVE-2015-1130 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 08 2015 12:00AM |
| Updated: | May 12 2015 07:47PM |
| Credit: | Apple, Emil Kvarnhammar at TrueSec, Ian Beer of Google Project Zero, Frank Graziano and John Villamil of the Yahoo Pentest Team, Izik Eidus and Alex Fishman, lokihardt@ASRT working with HP's Zero Day Initiative, Luca Todesco, and Ole Andre Vadla Ravnas of |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2015-004.
The update addresses new vulnerabilities that affect the Admin Framework, ATS, CoreAnimation, Graphics Driver, Hypervisor, ImageIO, IOHIDFamily, Kernel, LaunchServices, UniformTypeIdentifiers, Security - Code Signing, Open Directory Client, and Screen Sharing components.
Attackers can exploit these issues to execute arbitrary code with system privileges, gain admin privileges, bypass security restrictions, cause denial-of-service conditions, obtain sensitive information and perform other attacks.
These issues affect Mac OS X prior to 10.10.3.
Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2015-004.
The update addresses new vulnerabilities that affect the Admin Framework, ATS, CoreAnimation, Graphics Driver, Hypervisor, ImageIO, IOHIDFamily, Kernel, LaunchServices, UniformTypeIdentifiers, Security - Code Signing, Open Directory Client, and Screen Sharing components.
Attackers can exploit these issues to execute arbitrary code with system privileges, gain admin privileges, bypass security restrictions, cause denial-of-service conditions, obtain sensitive information and perform other attacks.
These issues affect Mac OS X prior to 10.10.3.
Exploit / POC
Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
Note: Some of these issues will not require specific exploit code and may be trivial to exploit.
The following metasploit exploit code is available:
Note: Some of these issues will not require specific exploit code and may be trivial to exploit.
The following metasploit exploit code is available:
Solution / Fix
Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Apple Mac OS X Prior to 10.10.3 Multiple Security Vulnerabilities
References:
References:
- Mac OS X Homepage (Apple)
- About the security content of OS X Yosemite v10.10.3 and Security Update 2015-00 (Apple)
- Apple OS X IOHIDSecurePromptClient Untrusted Pointer Dereference Arbitrary Code (TippingPoint Zero Day Initiative)
- Apple OS X IOKit IOHIDSecurePromptClient Heap Buffer Overflow Privilege Escalati (HP)