CVE-2013-3949

Name of the Vulnerable Software and Affected Versions XNU kernel in Apple Mac OS X version 10.8.x

Description The issue allows local users to bypass intended access restrictions. This is due to the posix spawn system call not preventing the use of certain flags for setuid and setgid programs. A wrapper program can exploit this by calling the posix spawnattr setflags function, potentially leading to unauthorized access.

Recommendations For Mac OS X version 10.8.x, consider restricting the use of the posix spawnattr setflags function to minimize the risk of exploitation. Additionally, avoid using the POSIX SPAWN DISABLE ASLR and POSIX SPAWN ALLOW DATA EXEC flags for setuid and setgid programs until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.