The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted update URL, as demonstrated by file:///tmp/blah/Arq.zip.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.html | Exploit Third Party Advisory VDB Entry |
| https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html | Third Party Advisory |
| https://www.exploit-db.com/exploits/43925/ | Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.html | Exploit Third Party Advisory VDB Entry |
| https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html | Third Party Advisory |
| https://www.exploit-db.com/exploits/43925/ | Exploit Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.html - Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/43925/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-01-31 20:29
Updated : 2024-11-21 03:17
NVD link : CVE-2017-16928
Mitre link : CVE-2017-16928
CVE.ORG link : CVE-2017-16928
JSON object : View
Products Affected
haystacksoftware
- arq
apple
- macos
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource