Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-6336: osquery may run unsigned code that appears Apple‑signed
CVE-2018-6336 · published 7 years ago
Summary
Versions of osquery older than 3.2.7 can be fooled by a specially crafted Mac program that looks like it is signed by Apple. Because osquery does not fully examine that program, hidden malicious code can run even though the signature seems valid. Upgrade osquery to version 3.2.7 or newer to protect against this.
What to do
- Update linuxfoundation osquery to version 3.2.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linuxfoundation | osquery |
< 3.2.7 cpe:2.3:a:linuxfoundation:osquery:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of ...
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7
References
- https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-... Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-2547PK - Security Features
CWE-354Improper Validation of Integrity Check Value
Timeline
Published31 Dec 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-6336 · NVD
Track software like this
Free during beta