QID 378361

Date Published: 2023-04-18

QID 378361: Qualys Cloud Agent For MacOS prior to 3.7.0.0 Local Privilege Esclation Vulnerability (Q-PVD-2023-04)

Qualys Cloud Agent for macOS (before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege.

QID Detection Logic:
Operating System: MacOS
The detections checks for QualysCloudAgent versions before 3.7.0.0

Successful exploitation will allow local privilege escalation

  • CVSS V3 rated as High - 7 severity.
  • CVSS V2 rated as High - 6 severity.
    • Solution
    Customers are advised to upgrade to v3.7 or higher of Qualys Cloud Agent for MacOS. If possible, customers should enable automatic updates.
    Vendor References

    CVEs related to QID 378361

    CVE-2023-28143 |
    Software Advisories
    Advisory ID Software Component Link
    Q-PVD-2023-04 URL Logo www.qualys.com/security-advisories/cve-2023-28143/
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].