CVE-2019-7249 Race condition in n/a
A local attacker can exploit a race condition in the Keybase macOS Helper to tamper with other users' installations and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7249?
CVE-2019-7249 is a critical vulnerability in n/a, published on 31 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with another's installs.
Weakness: CWE-367
Which versions are affected by CVE-2019-7249?
It affects 1 product.
Products include Keybase Keybase.
How do I fix CVE-2019-7249?
No fix has been published for CVE-2019-7249 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-7249 being exploited?
There is no known exploitation of CVE-2019-7249 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vr9v-36r3-5pfh.