| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <fc32a9d3-441e-adfe-03cf-043fd0ab4a08@securify.nl> Date: Mon, 14 Aug 2017 20:35:13 +0200 From: "Securify B.V. via Fulldisclosure" <fulldisclosure@...lists.org> To: fulldisclosure@...lists.org Subject: [FD] Xamarin Studio for Mac API documentation update affected by local privilege escalation ------------------------------------------------------------------------ Xamarin Studio for Mac API documentation update affected by local privilege escalation ------------------------------------------------------------------------ Yorick Koster, April 2017 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ Xamarin Studio is an Integrated Development Environment (IDE) used to create iOS, Mac and Android applications. Xamarin Studio supports developments in C# and F# (by default). The API documentation update mechanism of Xamarin Studio for Mac is installed as setuid root. This update mechanism contains several flaws that could be leveraged by a local attacker to gain elevated (root) privileges. ------------------------------------------------------------------------ See also ------------------------------------------------------------------------ - CVE-2017-8665 - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8665 ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully verified on Xamarin Studio for Mac version 6.2.1 (build 3) and version 6.3 (build 863). ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ Microsoft released a new version of Xamarin.iOS that addresses this issue: https://support.microsoft.com/en-us/help/4037359 ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20170403/xamarin-studio-for-mac-api-documentation-update-affected-by-local-privilege-escalation.html _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists