PT-2018-9870

CVE-2018-10406

Publicado

2018-06-13

Atualizado

2022-05-13

Descrição por

CVSS 4.0

8.4

Alta

MétricasAV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Yelp OSXCollector (affected versions not specified)

Description: A maliciously crafted Universal/fat binary can evade third-party code signing checks in Yelp OSXCollector. This occurs because the tool does not complete a full inspection of the Universal/fat binary, leading to the execution of malicious unsigned code. The user of the third-party tool may mistakenly believe the code is signed by Apple.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Explorabilidade

Exploit

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-295: Improper Certificate Validation

Identificadores relacionados

CVE-2018-10406

GHSA-G3CC-PVJJ-9XQ9