An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them. An attacker who successfully exploited the vulnerability who already has the ability to execute code on a system could elevate privileges. To exploit the vulnerability, the attacker could place a crafted executable in a specific location used by the update application to execute arbitrary code in a privileged context. This update addresses the vulnerability by ensuring that MAU for Mac properly validates packages prior to installing them.
Csaba Fitzl (@theevilbit) working with <a href="https://vcp.idefense.com">iDefense Labs</a>