In addition, Securify also discovered a similar local privilege escalation flaw in HideMyAss! Pro VPN for Mac. Tested on version 2.2.7.0, Sahin says this older version of the software is still available for download and according to HMA support, will not be fixed. "Taking the FirewallDisable rule as an example, there is no limit to which executable can be executed allowing a local user (or malware) to run any executable as root." "Although disabling the firewall is dangerous enough, it was found that the helper is affected by multiple local privilege escalation vulnerabilities," the researcher says. The helper, installed as root and responsible for loading kernel extensions and managing firewall rules and permissions, also includes the flaws which permit local attackers to exploit privilege escalation and gain root control of user accounts.
#HIDE MY ASS FOR OS X SOFTWARE FREE DOWNLOAD MAC OS X#
The bugs were discovered in the helper binary HMAHelper which ships with the Apple Mac OS X versions of HideMyAss!. The security flaw details and proof-of-concept (PoC) code was posted on Full Disclosure. Over the weekend, Securify researcher Han Sahin said that multiple privilege escalation vulnerabilities exist in HideMyAss! Pro VPN for Apple's OS X operating system, a subscription-based virtual private network (VPN) service used to mask user traffic and online activities. A set of serious security flaws in the HideMyAss! proxy service which could place user security and privacy at risk have been publicly disclosed.
0 kommentar(er)
