Description
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TeamViewer Full Client
Default version status: unaffected
0 to < 15.83affected14.7.0 to < 14.7.48868affected13.2.0 to < 13.2.154007affected
TeamViewer Host
Default version status: unaffected
0 to < 15.83affected14.7.0 to < 14.7.48868affected13.2.0 to < 13.2.154007affected