Keybase Pays $5,000 Bounties for Privilege Escalation Bugs in Linux and macOS Apps

guest · Dec 20, 2018

Keybase Pays $5,000 Bounties for Privilege Escalation Bugs in Linux and macOS Apps
December 20, 2018
https://www.bleepingcomputer.com/ne...lege-escalation-bugs-in-linux-and-macos-apps/

Helper process allows elevated privileges on macOS
Chester provided a detailed description of the vulnerability and proof-of-concept code that reproduced it. The flaw affected the Keybase Helper process which failed to do proper permission checks in app versions before 2.5.2.

Chester discovered that any user, regardless of their permissions level on the system, can interact with the Helper process using the MPXPCClient in the MPMessagePack framework.
Running any file with root permission on Linux
Keybase received on October 23 another submission for the same type of bug from Rich Mirch, this time exploitable in the Linux version of the app.

An advisory from Keybase explains that an "attack was possible due to a previous version of keybase-redirector that used the fusermount binary to create the /keybase mountpoint."
Click to expand...

Log in or Sign up

Keybase Pays $5,000 Bounties for Privilege Escalation Bugs in Linux and macOS Apps

guest Guest

Log in or Sign up

Keybase Pays $5,000 Bounties for Privilege Escalation Bugs in Linux and macOS Apps

guest Guest

Useful Searches