CVE-2019-13014

Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.9 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://obdev.at/cve/2019-13014-MzE24Ify4p.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:obdev:little_snitch:4.4.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-08-23 17:15

Updated : 2023-11-07 03:03

NVD link : CVE-2019-13014

Mitre link : CVE-2019-13014

CVE.ORG link : CVE-2019-13014

JSON object : View

Products Affected

obdev

little_snitch

CWE

CWE-459

Incomplete Cleanup

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2019-13014", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-08-23T17:15:13.667", "references": [{"url": "https://obdev.at/cve/2019-13014-MzE24Ify4p.html", "source": "office@obdev.at"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-459"}]}, {"type": "Secondary", "source": "office@obdev.at", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade."}, {"lang": "es", "value": "Little Snitch versiones 4.4.0 corrige una vulnerabilidad en una herramienta auxiliar privilegiada. Sin embargo, el sistema operativo puede haber hecho una copia del ayudante privilegiado que no se elimina o actualiza de inmediato. Por lo tanto, las computadoras a\u00fan pueden ser vulnerables despu\u00e9s de actualizar a 4.4.0. La versi\u00f3n 4.4.1 corrige este problema eliminando la copia del sistema operativo durante la actualizaci\u00f3n."}], "lastModified": "2023-11-07T03:03:45.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:obdev:little_snitch:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797ECF4F-4B0D-417B-8DE8-24BDE95BD8AB"}], "operator": "OR"}]}], "sourceIdentifier": "office@obdev.at"}