CVE-2021-30657 in apple mac os x
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited..
Affected software: apple mac os x, apple macos
Scores
- CVSS: 5.5 (medium)
- EPSS: 68.53% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-11-03
- Published: 2021-09-08
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update macOS to Big Sur 11.3 or install Security Update 2021-002 Catalina (Gatekeeper bypass)
Patch or upgrade. Apple fixed the Gatekeeper logic flaw that lets a crafted, unsigned app bundle (no Info.plist, script as executable) run without the Gatekeeper and notarization checks, as used by Shlayer malware. Installing the fixed macOS release removes the bypass.
Applies to: macOS Big Sur before 11.3 and macOS Catalina 10.15.7 without Security Update 2021-002.
- Inventory Macs and their macOS version (Apple menu > About This Mac, or `sw_vers` / your MDM inventory such as Jamf or Intune).
- Macs on macOS Big Sur 11.0 to 11.2.x: update to macOS Big Sur 11.3 or later (System Preferences > Software Update, or push via MDM). Prefer the latest supported macOS release.
- Macs on macOS Catalina 10.15.7: install Security Update 2021-002 Catalina or later (System Preferences > Software Update).
- Macs on older releases (Mojave and earlier) receive no fix: upgrade them to a supported macOS release or take them out of use.
- Restart the Macs to finish the update and confirm with `sw_vers` that the build is at or above the fixed release.
- Keep Gatekeeper on (`spctl --status` must say 'assessments enabled') and block users from running apps from unidentified developers through an MDM configuration profile.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.