Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug

guest · Aug 27, 2021

Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug
August 27, 2021
https://threatpost.com/parallels-inconvenient-fix/168997/

The makers of Parallels Desktop has released a workaround fix for a high-severity privilege escalation bug that impacts its Parallels Desktop 16 for Mac software and all older versions. Mitigation advice comes five months after researchers first identified the bug in April.

The vulnerability allows malicious software running in a Parallels virtual machine (VM) to access macOS files shared in a default configuration of the software. The software maker stated that the recommended fixes need to be manually performed by end users and will likely “inconvenience” some while also reducing product functionality.
Click to expand...

In a Wednesday security bulletin, first to widely disclose details of the bug, it was revealed that the vulnerability (CVE-2021-34864) is caused by improper access control in the Parallels’ WinAppHelper component. The flaw, according to Parallels, is specifically tied to the software’s Parallels Tools, a proxy for communications between the host macOS and the virtual machine’s operating system.
An Easy-to-Exploit Bug

“The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor,” according to a separate security advisory, also posted Wednesday.
The severity of the vulnerability is rated as high (8.8) using the Common Vulnerability Scoring System, version 3.0.
Click to expand...

“Parallels Desktop 17 for Mac and newer versions are not affected. The entire home folder is no longer shared with a VM by default, only selected folders, like Desktop, Documents, Downloads, etc.,” according to the vulnerability’s summary description.
Click to expand...

To mitigate against the vulnerability, Parallels Desktop 16 for Mac users (and other legacy users) have a number of options. The first option is to upgrade to Parallels Desktop 17 for Mac, which does not contain the flaw.
Parallels: An Inconvenient Fix
For customers running Parallels Desktop 16 users or earlier versions of the software, the company said the fixes available to them will “reduce functionality” of the software and cause “inconveniences,” such as file duplications when sharing documents across VM and the host macOS.
Click to expand...

Log in or Sign up

Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug

guest Guest

Log in or Sign up

Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug

guest Guest

Useful Searches