Sign-up

ID

VAR-202010-1269


CVE

CVE-2020-9866


TITLE

Apple macOS Catalina Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202007-1065

DESCRIPTION

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. A buffer overflow may result in arbitrary code execution. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A buffer overflow vulnerability exists in the CoreAudio component of Apple macOS Catalina prior to 10.15.6. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative CVE-2020-9889: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab Audio Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9888: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab CVE-2020-9890: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab CVE-2020-9891: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab Clang Available for: macOS Catalina 10.15.5 Impact: Clang may generate machine code that does not correctly enforce pointer authentication codes Description: A logic issue was addressed with improved validation. CVE-2020-9866: Yu Zhou of 小鸡帮 and Jundong Xie of Ant-financial Light- Year Security Lab CoreFoundation Available for: macOS Catalina 10.15.5 Impact: A local user may be able to view sensitive user information Description: An issue existed in the handling of environment variables. CVE-2020-9934: an anonymous researcher Crash Reporter Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to break out of its sandbox Description: A memory corruption issue was addressed by removing the vulnerable code. CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud Grpahics Drivers Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9799: ABC Research s.r.o. Heimdal Available for: macOS Catalina 10.15.5 Impact: A local user may be able to leak sensitive user information Description: This issue was addressed with improved data protection. CVE-2020-9913: Cody Thomas of SpecterOps ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9936: Mickey Jin of Trend Micro Kernel Available for: macOS Catalina 10.15.5 Impact: An attacker in a privileged network position may be able to inject into active connections within a VPN tunnel Description: A routing issue was addressed with improved restrictions. CVE-2019-14899: William J. Tolley, Beau Kujath, and Jedidiah R. Crandall Mail Available for: macOS Catalina 10.15.5 Impact: A remote attacker can cause a limited out-of-bounds write, resulting in a denial of service Description: An input validation issue was addressed. CVE-2019-19906 Messages Available for: macOS Catalina 10.15.5 Impact: A user that is removed from an iMessage group could rejoin the group Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha) Model I/O Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security Security Available for: macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved restrictions. CVE-2020-9864: Alexander Holodny Vim Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause arbitrary code execution Description: This issue was addressed with improved checks. CVE-2019-20807: Guilherme de Almeida Suckevicz Wi-Fi Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn) Additional recognition USB Audio We would like to acknowledge Andy Davis of NCC Group for their assistance

Trust: 1.17

sources: NVD: CVE-2020-9866 // VULHUB: VHN-187991 // VULMON: CVE-2020-9866 // PACKETSTORM: 158457

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.15.6

Trust: 1.0

sources: NVD: CVE-2020-9866

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-9866
value: CRITICAL

Trust: 1.0

CNNVD: CNNVD-202007-1065
value: CRITICAL

Trust: 0.6

VULHUB: VHN-187991
value: HIGH

Trust: 0.1

VULMON: CVE-2020-9866
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-9866
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-187991
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-9866
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-187991 // VULMON: CVE-2020-9866 // CNNVD: CNNVD-202007-1065 // NVD: CVE-2020-9866

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.1

sources: VULHUB: VHN-187991 // NVD: CVE-2020-9866

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-1065

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202007-1065

PATCH

title:Apple macOS Catalina CoreAudio Fix for component buffer error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=124552

Trust: 0.6

title:Apple: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierraurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=aa30f53f014f01d7a0510a965599d2a9

Trust: 0.1

title: - url:https://www.theregister.co.uk/2020/07/16/apple_july_updates/

Trust: 0.1

sources: VULMON: CVE-2020-9866 // CNNVD: CNNVD-202007-1065

EXTERNAL IDS

db:NVDid:CVE-2020-9866

Trust: 1.9

db:PACKETSTORMid:158457

Trust: 0.7

db:NSFOCUSid:50131

Trust: 0.6

db:AUSCERTid:ESB-2020.2430

Trust: 0.6

db:CNNVDid:CNNVD-202007-1065

Trust: 0.6

db:CNVDid:CNVD-2020-49303

Trust: 0.1

db:VULHUBid:VHN-187991

Trust: 0.1

db:VULMONid:CVE-2020-9866

Trust: 0.1

sources: VULHUB: VHN-187991 // VULMON: CVE-2020-9866 // PACKETSTORM: 158457 // CNNVD: CNNVD-202007-1065 // NVD: CVE-2020-9866

REFERENCES

url:https://support.apple.com/en-us/ht211289

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-9866

Trust: 0.7

url:https://support.apple.com/kb/ht211289

Trust: 0.6

url:https://packetstormsecurity.com/files/158457/apple-security-advisory-2020-07-15-2.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2430/

Trust: 0.6

url:http://www.nsfocus.net/vulndb/50131

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/120.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/185428

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9918

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9878

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-19906

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9889

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9799

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9913

Trust: 0.1

url:https://support.apple.com/downloads/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9864

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9884

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9934

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9888

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-14899

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9885

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9891

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9870

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2019-20807

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9936

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9890

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-9865

Trust: 0.1

sources: VULHUB: VHN-187991 // VULMON: CVE-2020-9866 // PACKETSTORM: 158457 // CNNVD: CNNVD-202007-1065 // NVD: CVE-2020-9866

CREDITS

Apple

Trust: 0.7

sources: PACKETSTORM: 158457 // CNNVD: CNNVD-202007-1065

SOURCES

db:VULHUBid:VHN-187991
db:VULMONid:CVE-2020-9866
db:PACKETSTORMid:158457
db:CNNVDid:CNNVD-202007-1065
db:NVDid:CVE-2020-9866

LAST UPDATE DATE

2024-11-23T20:26:47.341000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-187991date:2020-10-29T00:00:00
db:VULMONid:CVE-2020-9866date:2020-10-29T00:00:00
db:CNNVDid:CNNVD-202007-1065date:2020-11-03T00:00:00
db:NVDid:CVE-2020-9866date:2024-11-21T05:41:26.177

SOURCES RELEASE DATE

db:VULHUBid:VHN-187991date:2020-10-27T00:00:00
db:VULMONid:CVE-2020-9866date:2020-10-27T00:00:00
db:PACKETSTORMid:158457date:2020-07-17T19:23:49
db:CNNVDid:CNNVD-202007-1065date:2020-07-15T00:00:00
db:NVDid:CVE-2020-9866date:2020-10-27T21:15:15.633