Executive Summary

Aquarius Desktop 3.0.069 for macOS has a vulnerability in its support data archive generation feature where it follows symbolic links inside the ~/Library/Logs/Aquarius directory as if they were regular files. This means that when the application builds the support ZIP file, it recursively enumerates logs and writes file data without checking if the files are actually symbolic links. A local attacker can exploit this by placing symlinks to arbitrary filesystem locations, potentially causing unauthorized disclosure or modification of files. If combined with a related privilege escalation issue, even root-owned files could be exposed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure or modification of arbitrary files on the affected system. A local attacker could exploit it to access sensitive information or alter files they should not have access to. If combined with a privilege escalation vulnerability, it could expose even root-owned files, significantly increasing the risk and impact.

Useful 0 Not Useful 0