CVE-2024-8272 (GCVE-0-2024-8272)

Vulnerability from cvelistv5 – Published: 2024-11-25 17:52 – Updated: 2024-11-25 18:42
VLAI?
Summary
The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privileges to root.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
Universal Audio UAConnect Affected: 0 , ≤ 2.7.0 (semver)
Create a notification for this product.
Credits
Carlos Garrido of Pentraze Cybersecurity
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:universal_audio:uaconnect:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "uaconnect",
            "vendor": "universal_audio",
            "versions": [
              {
                "lessThanOrEqual": "2.7.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-25T18:40:43.231674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-25T18:42:00.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.uaudio.com",
          "defaultStatus": "unaffected",
          "modules": [
            "com.uaudio.bsd.helper"
          ],
          "packageName": "UAConnect",
          "platforms": [
            "MacOS"
          ],
          "product": "UAConnect",
          "vendor": "Universal Audio",
          "versions": [
            {
              "lessThanOrEqual": "2.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Carlos Garrido of Pentraze Cybersecurity"
        }
      ],
      "datePublic": "2024-11-25T17:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \u003cb\u003ecom.uaudio.bsd.helper\u003c/b\u003e\u0026nbsp;service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to \u003cb\u003eroot\u003c/b\u003e.\u003cbr\u003e"
            }
          ],
          "value": "The com.uaudio.bsd.helper\u00a0service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to root."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-25T17:52:14.805Z",
        "orgId": "41c37e40-543d-43a2-b660-2fee83ea851a",
        "shortName": "Pentraze"
      },
      "references": [
        {
          "url": "https://pentraze.com/vulnerability-reports"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "macOS Universal Audio (UAConnect) \u003c= 2.7.0  - Local Privilege Escalation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "41c37e40-543d-43a2-b660-2fee83ea851a",
    "assignerShortName": "Pentraze",
    "cveId": "CVE-2024-8272",
    "datePublished": "2024-11-25T17:52:14.805Z",
    "dateReserved": "2024-08-28T17:48:16.683Z",
    "dateUpdated": "2024-11-25T18:42:00.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The com.uaudio.bsd.helper\\u00a0service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to root.\"}, {\"lang\": \"es\", \"value\": \"El servicio com.uaudio.bsd.helper, responsable de gestionar operaciones privilegiadas, no implementa una validaci\\u00f3n cr\\u00edtica del cliente durante la comunicaci\\u00f3n entre procesos (IPC) de XPC. En concreto, el servicio no verifica los requisitos de c\\u00f3digo, los derechos ni los indicadores de seguridad de ning\\u00fan cliente que intente establecer una conexi\\u00f3n. Esta falta de validaci\\u00f3n adecuada permite que clientes no autorizados exploten los m\\u00e9todos del servicio y escalen privilegios a superusuario.\"}]",
      "id": "CVE-2024-8272",
      "lastModified": "2024-11-25T18:15:14.673",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"41c37e40-543d-43a2-b660-2fee83ea851a\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-11-25T18:15:14.673",
      "references": "[{\"url\": \"https://pentraze.com/vulnerability-reports\", \"source\": \"41c37e40-543d-43a2-b660-2fee83ea851a\"}]",
      "sourceIdentifier": "41c37e40-543d-43a2-b660-2fee83ea851a",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"41c37e40-543d-43a2-b660-2fee83ea851a\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8272\",\"sourceIdentifier\":\"41c37e40-543d-43a2-b660-2fee83ea851a\",\"published\":\"2024-11-25T18:15:14.673\",\"lastModified\":\"2024-11-25T18:15:14.673\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The com.uaudio.bsd.helper\u00a0service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to root.\"},{\"lang\":\"es\",\"value\":\"El servicio com.uaudio.bsd.helper, responsable de gestionar operaciones privilegiadas, no implementa una validaci\u00f3n cr\u00edtica del cliente durante la comunicaci\u00f3n entre procesos (IPC) de XPC. En concreto, el servicio no verifica los requisitos de c\u00f3digo, los derechos ni los indicadores de seguridad de ning\u00fan cliente que intente establecer una conexi\u00f3n. Esta falta de validaci\u00f3n adecuada permite que clientes no autorizados exploten los m\u00e9todos del servicio y escalen privilegios a superusuario.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"41c37e40-543d-43a2-b660-2fee83ea851a\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"41c37e40-543d-43a2-b660-2fee83ea851a\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://pentraze.com/vulnerability-reports\",\"source\":\"41c37e40-543d-43a2-b660-2fee83ea851a\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8272\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-25T18:40:43.231674Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:universal_audio:uaconnect:*:*:*:*:*:*:*:*\"], \"vendor\": \"universal_audio\", \"product\": \"uaconnect\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.0\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-25T18:41:55.457Z\"}}], \"cna\": {\"title\": \"macOS Universal Audio (UAConnect) \u003c= 2.7.0  - Local Privilege Escalation\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Carlos Garrido of Pentraze Cybersecurity\"}], \"impacts\": [{\"capecId\": \"CAPEC-233\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-233 Privilege Escalation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Universal Audio\", \"modules\": [\"com.uaudio.bsd.helper\"], \"product\": \"UAConnect\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.7.0\"}], \"platforms\": [\"MacOS\"], \"packageName\": \"UAConnect\", \"collectionURL\": \"https://www.uaudio.com\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-11-25T17:51:00.000Z\", \"references\": [{\"url\": \"https://pentraze.com/vulnerability-reports\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The com.uaudio.bsd.helper\\u00a0service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to root.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The \u003cb\u003ecom.uaudio.bsd.helper\u003c/b\u003e\u0026nbsp;service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to \u003cb\u003eroot\u003c/b\u003e.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"41c37e40-543d-43a2-b660-2fee83ea851a\", \"shortName\": \"Pentraze\", \"dateUpdated\": \"2024-11-25T17:52:14.805Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8272\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-25T18:42:00.202Z\", \"dateReserved\": \"2024-08-28T17:48:16.683Z\", \"assignerOrgId\": \"41c37e40-543d-43a2-b660-2fee83ea851a\", \"datePublished\": \"2024-11-25T17:52:14.805Z\", \"assignerShortName\": \"Pentraze\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.