CVE-2021-26737: Privilege Escalation Using PID Reuse in ZCC macOS

Privilege Escalation Using PID Reuse in ZCC macOS

Status

Published

2023-10-23

Updated

2024-09-11

Assigning organization

Zscaler

Description

The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zscaler Client Connector

Default version status: unaffected

0 to < 3.6affected

References

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.6&deployment_date=2022-01-07&id=1388686 ↗