Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the Technical Data Reporter component of Parallels Desktop. This issue allows attackers with low privileges to escalate their rights and execute arbitrary code as root. The vulnerability arises from the ability to create symbolic links that the service can inadvertently follow, leading to unauthorized changes in file permissions.

Impact

Exploitation of this vulnerability allows for local privilege escalation, enabling an attacker to execute code with root privileges.

Remediation

Parallels has released an update to address this vulnerability. Users can refer to the Parallels Knowledge Base article 130212 for more details.