high7.8Known exploitedPublic exploit code
CVE-2015-1130
Apple OS X Authentication Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-02-10. Federal due date: 2022-08-10.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apple Mac OSX - 'Rootpipe' Local Privilege Escalation (Metasploit)2015-04-13 · local · osx · Verified
- Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation2015-04-09 · local · osx · Verified
Impact
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Mac Os X | before 10.10.3 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://www.osvdb.org/120418
- http://www.securityfocus.com/bid/73982
- http://www.securitytracker.com/id/1032048
- https://support.apple.com/HT204659
- https://www.exploit-db.com/exploits/36692/
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://www.osvdb.org/120418
- http://www.securityfocus.com/bid/73982
- http://www.securitytracker.com/id/1032048
- https://support.apple.com/HT204659
- https://www.exploit-db.com/exploits/36692/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1130