CVE-2025-65842
中文标题:
（暂无数据）
英文标题:
The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow...
漏洞描述
中文描述:
（暂无数据）
英文描述:
The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client's identity, and its authorization logic incorrectly calls AuthorizationCopyRights with a NULL reference, causing all authorization checks to succeed. The executeCommand:authorization:withReply: method then interpolates attacker-controlled input into NSTask and executes it with root privileges. A local attacker can exploit these weaknesses to run arbitrary commands as root, create persistent backdoors, or obtain a fully interactive root shell.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| acustica-audio | aquarius_helpertool | 1.0.003 | - | - |
cpe:2.3:a:acustica-audio:aquarius_helpertool:1.0.003:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-65842 |
2025-12-07 02:05:13 | 2026-01-12 02:12:22 |
| NVD | nvd_CVE-2025-65842 |
2025-12-19 03:25:49 | 2026-01-12 02:28:03 |
版本与语言
安全公告
变更历史
查看详细变更
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']