Kernel Buffer Overflow in Trusteer Rapport for MacOS

guest · Dec 21, 2018

Kernel Buffer Overflow in Trusteer Rapport for MacOS
December 20, 2018
https://www.trustwave.com/en-us/res...uffer-overflow-in-trusteer-rapport-for-macos/

Trustwave recently reported a Kernel based vulnerability in a driver bundled along with IBM Trusteer Rapport for MacOS. The vulnerability is a signedness bug leading to a Kernel stack memory corruption issue in a call to memcpy.
The Issue
The root cause of the issue is a signedness bug in validating the user-supplied number of elements provided by the user in the structure passed to the Kernel driver function via a call to an struct method exported from the Kernel driver with the IOService 'com_trusteer_rapportke_v2'. [...]

Trustwave worked with IBM throughout the disclosure process. When IBM was unable to provide a patch during our 90-day disclosure policy, we extended to them an additional 30 days. Unfortunately, that was also not enough time to develop a patch, and we feel it's important to alert the public about this issue.
Click to expand...

Although there is currently no patch, the risk of this vulnerability is slightly mitigated by requiring local access, so those affected are recommended to verify that only authorized users can log in to those systems.
Click to expand...

Rasheed187 · Dec 22, 2018

No surprise, I would stay away from Trusteer Rapport, I've always read bad stuff about it, related to stability and compatibility. On the other hand, it does offer strong protection, but it's a bit too intrusive.

Log in or Sign up

Kernel Buffer Overflow in Trusteer Rapport for MacOS

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Kernel Buffer Overflow in Trusteer Rapport for MacOS

guest Guest

Rasheed187 Registered Member

Useful Searches