CVE-2017-16928

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted update URL, as demonstrated by file:///tmp/blah/Arq.zip.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.htmlThird Party Advisory
https://www.exploit-db.com/exploits/43925/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/146158/Arq-5.10-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://m4.rkw.io/blog/two-local-root-privesc-bugs-in-arq-backup--510.htmlThird Party Advisory
https://www.exploit-db.com/exploits/43925/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-169298.1The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability expl CVE-2017-16935.6IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small CVE-2017-169309.8The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due CVE-2017-169319.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference functio CVE-2017-169327.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.CVE-2017-169337.0etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local use CVE-2017-169349.8The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.ht CVE-2017-169359.8Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended acc CVE-2017-169366.5Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(631 CVE-2017-169387.8A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a mal CVE-2017-169397.8The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or caus CVE-2017-16948.1IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle