ZDI-CAN-13543: (Pwn2Own) Parallels Desktop WinAppHelper Improper Access Control Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the WinAppHelper component. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-13543?
ZDI-CAN-13543 has a severity rating that indicates a significant risk of privilege escalation for local attackers.
How do I fix ZDI-CAN-13543?
To fix ZDI-CAN-13543, ensure that you update your Parallels Desktop software to the latest version provided by Parallels.
What types of systems are affected by ZDI-CAN-13543?
ZDI-CAN-13543 affects installations of Parallels Desktop for Mac.
Who can exploit ZDI-CAN-13543?
Local attackers who have the ability to execute low-privileged code on the target guest system can exploit ZDI-CAN-13543.
What are the potential consequences of ZDI-CAN-13543?
Exploitation of ZDI-CAN-13543 can lead to unauthorized privilege escalation, allowing attackers to gain higher access rights on the affected system.