The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink attack on the updater binary itself.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Link | Tags |
|---|---|
| https://m4.rkw.io/blog/cve201715357-local-root-privesc-in-arq-backup--596.html | third party advisory exploit |
| https://www.exploit-db.com/exploits/43218/ | exploit vdb entry third party advisory |
| https://www.arqbackup.com/download/arq5_release_notes.html | release notes vendor advisory |