Sign-up

ID

VAR-202208-1613


CVE

CVE-2022-26696


TITLE

apple's  macOS  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-019246

DESCRIPTION

This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions. apple's macOS Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to escape the sandbox on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of XPC messages in the LaunchServices component. A crafted message can trigger execution of a privileged operation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user

Trust: 2.34

sources: NVD: CVE-2022-26696 // JVNDB: JVNDB-2022-019246 // ZDI: ZDI-22-1066 // VULHUB: VHN-417365

AFFECTED PRODUCTS

vendor:applemodel:macosscope:ltversion:12.4

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0.0

Trust: 1.0

vendor:アップルmodel:macosscope:eqversion:12.0.0 that's all 12.4

Trust: 0.8

vendor:アップルmodel:macosscope:eqversion: -

Trust: 0.8

vendor:applemodel:macosscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-1066 // JVNDB: JVNDB-2022-019246 // NVD: CVE-2022-26696

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-26696
value: HIGH

Trust: 1.0

NVD: CVE-2022-26696
value: HIGH

Trust: 0.8

ZDI: CVE-2022-26696
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202209-1609
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-26696
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.0
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2022-26696
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-26696
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1066 // JVNDB: JVNDB-2022-019246 // CNNVD: CNNVD-202209-1609 // NVD: CVE-2022-26696

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-019246 // NVD: CVE-2022-26696

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202209-1609

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202209-1609

PATCH

title:HT213257 Apple  Security updateurl:https://support.apple.com/en-us/HT213257

Trust: 0.8

title:Apple macOS Monterey Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=208799

Trust: 0.6

sources: JVNDB: JVNDB-2022-019246 // CNNVD: CNNVD-202209-1609

EXTERNAL IDS

db:NVDid:CVE-2022-26696

Trust: 4.0

db:JVNDBid:JVNDB-2022-019246

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15588

Trust: 0.7

db:ZDIid:ZDI-22-1066

Trust: 0.7

db:CNNVDid:CNNVD-202209-1609

Trust: 0.6

db:VULHUBid:VHN-417365

Trust: 0.1

sources: ZDI: ZDI-22-1066 // VULHUB: VHN-417365 // JVNDB: JVNDB-2022-019246 // CNNVD: CNNVD-202209-1609 // NVD: CVE-2022-26696

REFERENCES

url:https://support.apple.com/en-us/ht213257

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2022-26696

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-26696/

Trust: 0.6

sources: VULHUB: VHN-417365 // JVNDB: JVNDB-2022-019246 // CNNVD: CNNVD-202209-1609 // NVD: CVE-2022-26696

CREDITS

Wojciech Reguła (@_r3ggi)

Trust: 0.7

sources: ZDI: ZDI-22-1066

SOURCES

db:ZDIid:ZDI-22-1066
db:VULHUBid:VHN-417365
db:JVNDBid:JVNDB-2022-019246
db:CNNVDid:CNNVD-202209-1609
db:NVDid:CVE-2022-26696

LAST UPDATE DATE

2024-08-14T14:49:39.644000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1066date:2022-08-15T00:00:00
db:VULHUBid:VHN-417365date:2022-09-22T00:00:00
db:JVNDBid:JVNDB-2022-019246date:2023-10-25T02:37:00
db:CNNVDid:CNNVD-202209-1609date:2022-09-23T00:00:00
db:NVDid:CVE-2022-26696date:2022-09-22T20:25:34.193

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1066date:2022-08-15T00:00:00
db:VULHUBid:VHN-417365date:2022-09-20T00:00:00
db:JVNDBid:JVNDB-2022-019246date:2023-10-25T00:00:00
db:CNNVDid:CNNVD-202209-1609date:2022-09-20T00:00:00
db:NVDid:CVE-2022-26696date:2022-09-20T21:15:10.333