Researchers at the Cisco Talos Intelligence Group, a commercial threat intelligence team that’s part of tech giant Cisco, recently discovered several vulnerabilities within Microsoft apps for macOS that could put users at risk of having their devices hijacked by bad actors.
“We identified eight vulnerabilities in various Microsoft applications for macOS, through which an attacker could bypass the operating system’s permission model by using existing app permissions without prompting the user for any additional verification,” Cisco Talos’s Francesco Benvenuto said in a blog post.
Cisco Talos discovered these vulnerabilities as part of a recent analysis its researchers conducted of macOS’s permission-based security model, which revolves around Apple’s Transparency, Consent, and Control (TCC) framework. The TCC framework allows users to control whether an app has access to resources such as the microphone, camera, storage, user input, screen recording capabilities, and more.
Per Talos’s findings, attackers could exploit the discovered vulnerabilities by injecting malicious libraries into the affected Microsoft apps.
If successfully exploited, these vulnerabilities could give threat actors access to the same resources and permissions as the exploited app, with the targeted user being none the wiser. For example, an attacker could send emails from the user’s account in Microsoft Outlook, record audio through the microphone, take pictures, or even record video without the need for any user interaction.
The uncovered vulnerabilities are being tracked as CVE-2024-42220, CVE-2024-42004, CVE-2024-39804, CVE-2024-41159, CVE-2024-43106, CVE-2024-41165, CVE-2024-41145, and CVE-2024-41138. Affected apps include Microsoft Outlook, Microsoft Teams (work or school), Microsoft PowerPoint, Microsoft OneNote, Microsoft Excel, and Microsoft Word.
According to Talos, Microsoft considers these vulnerabilities to be low risk and doesn’t plan on fixing them. Furthermore, the tech giant said that some of its macOS apps need to allow the loading of unsigned libraries to support plugins.
Cybersecurity researchers recently discovered instances of hackers exploiting an 18-year-old vulnerability in web browsers like Safari, Google Chrome, and Firefox. Earlier this year, researchers also found an unfixable security vulnerability in Apple’s M-series chips for Macs.
Want to see more of our stories on Google?
P.S. Want to keep this site truly independent? Support us by buying us a beer, treating us to a coffee, or shopping through Amazon here. Links in this post are affiliate links, so we earn a tiny commission at no charge to you. Thanks for supporting independent Canadian media!
