full-disclosure - [FD] SSD Advisory

Open Source and information security mailing list archives

Message-ID: <CAAnZqX_o09Eg53UZGHdPKrw40w0y99kFSXAg62F1XzhnbYyZ5Q@mail.gmail.com>
Date: Tue, 3 Oct 2017 08:29:22 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Cc: SecuriTeam Secure Disclosure <ssd@...ondsecurity.com>
Subject: [FD] SSD Advisory – Mac OS X 10.12 Quarantine Bypass

SSD Advisory – Mac OS X 10.12 Quarantine Bypass

Full report: https://blogs.securiteam.com/index.php/archives/3449
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerability summary
Mac OS X contains a vulnerability that allows bypassing of the Apple
Quarantine and the execution of arbitrary JavaScript code without any
restrictions.

Credit
A security researcher from WeAreSegment, Filippo Cavallarin, has reported
this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program.

Vendor response
Apple has been notified on the 27th of June 2017, several correspondences
were exchanged. Apple notified us that a patch has been put in place in the
upcoming High Sierra version. No additional information has been provided
by Apple since the notification that a patch has been made – no link to the
advisory nor any information on what CVE has been assigned to this have
been provided.

We have verified that Mac OS X High Sierra is no longer vulnerable to this,
a solution would be to either upgrade High Sierra, or remove the
rhtmlPlayer.html file (a workaround).

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – Mac OS X 10.pdf" of type "application/pdf" (118196 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives