CVE-2015-3673

High

Published: 03/07/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, allowing local users to obtain root privileges by moving and modifying Directory Utility.

Risk Assessment

Local users can gain unauthorized access to administrator privileges, posing a significant security risk to the system.

Recommendation

It is recommended to update the system to version 10.10.4 or later to mitigate this vulnerability.

Other vulnerabilities in Admin Framework w Apple OS X

CVE-2015-3671High
Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements, allowing local users to bypass authentication and obtain admin privileges via unspecified vectors.

Original NVD description (English source)

Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS