PT-2018-9870

CVE-2018-10406

Published

2018-06-13

Updated

2022-05-13

Description by

CVSS 4.0

8.4

High

MetricsAV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Yelp OSXCollector (affected versions not specified)

Description: A maliciously crafted Universal/fat binary can evade third-party code signing checks in Yelp OSXCollector. This occurs because the tool does not complete a full inspection of the Universal/fat binary, leading to the execution of malicious unsigned code. The user of the third-party tool may mistakenly believe the code is signed by Apple.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation

Related identifiers

CVE-2018-10406

GHSA-G3CC-PVJJ-9XQ9