CVE-2017-16895

moderate-risk

Published 2017-12-01

The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper apps in Arq 5.x before 5.10 for Mac allow local users to gain root privileges via a crafted data packet.

Do I need to act?

0.28% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

43216

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (1)

Arq

Affected Vendors

Arqbackup

References (6)

Third Party Advisory https://m4.rkw.io/blog/cve201716895-local-root-privesc-in-arq-backup--597.html

Broken Link https://www.arqbackup.com/blog/arq-mac-import-security-update/

Third Party Advisory https://www.exploit-db.com/exploits/43216/

Third Party Advisory https://m4.rkw.io/blog/cve201716895-local-root-privesc-in-arq-backup--597.html

Broken Link https://www.arqbackup.com/blog/arq-mac-import-security-update/

Third Party Advisory https://www.exploit-db.com/exploits/43216/

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 8/34 · Low

Exposure 5/34 · Minimal