#MacAdmins Archives - Page 10 of 18

MacOS Security Updates – Mojave 2020-002 & High Sierra 2020-002

MrMacintosh.com - MacOS Mojave Security Update 2020-002 (18G4032), High Sierra Security Update 2020-002 (17G12034) and Safari 13.1. Security Notes, Download Links & more! — The Security Update 2020-002 for Mojave and High Sierra is now available.

Security Updates for macOS 10.14 & 10.13 are now Available.

Today, Apple released macOS Mojave Security Update 2020-002 and High Sierra Security Update 2020-002. Below you will find Build Versions, Download Links, Update Sizes and previous Security Update Links. MacOS Sierra is no longer supported by Apple for Security Updates.

How do I keep track of all the macOS Build Versions?

I document all of the macOS Build Versions like the latest Mojave 2020-002 High Sierra 2020-002 along with most Apple Applications, XProtect, Gatekeeper and MRT updates in one database. You can check out the link below.

mrmacintosh.com/macos-system-status-version-info-for-macadmins/

MacOS Mojave Security Update 2020-002 (18G4032)

macOS Mojave Security Update 2020-002
Size = 1.62gb
Package Download and Information Link
https://support.apple.com/kb/DL2035

Information on the Security fixes included in the 2020-002 Mojave Security Update

https://support.apple.com/en-us/HT211100

MacOS High Sierra Security Update 2020-002 (17G12034)

10.13.6 High Sierra Security Update 2020-002
Size = 2.1gb
Package Download and Information Link
https://support.apple.com/kb/DL2034

Information on the Security fixes included in the 2020-002 High Sierra Security Update

https://support.apple.com/en-us/HT211100

Safari Update

Safari was updated to version 13.1

Download Size for High Sierra = 66.2mb

Downloads Size for Mojave = 70.5mb

T2 BridgeOS Update

Both the 2020-002 and 2020-002 Security Updates upgrade BridgeOS to version – 17.16.14263

Security Content for Safari 13.1

https://support.apple.com/en-us/HT211104

Previous Releases

Security Related Content for 2020-002

Security Update 2020-002 Mojave, Security Update 2020-002 High Sierra

Released March 24, 2020

AppleGraphicsControl

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: Multiple memory corruption issues were addressed with improved state management.

CVE-2020-3904: Proteas of Qihoo 360 Nirvan Team

Bluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3907: Yu Wang of Didi Research America

CVE-2020-3908: Yu Wang of Didi Research America

CVE-2020-3912: Yu Wang of Didi Research America

Bluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3892: Yu Wang of Didi Research America

CVE-2020-3893: Yu Wang of Didi Research America

CVE-2020-3905: Yu Wang of Didi Research America

Bluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2019-8853: Jianjun Dai of Qihoo 360 Alpha Lab

IOHIDFamily

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3919: an anonymous researcher

IOThunderboltFamily

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6

Impact: An application may be able to gain elevated privileges

Description: A use after free issue was addressed with improved memory management.

CVE-2020-3851: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc. and Luyi Xing of Indiana University Bloomington

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3914: pattern-f (@pattern_F_) of WaCai

libxml2

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: Multiple issues in libxml2

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2020-3909: LGTM.com

CVE-2020-3911: found by OSS-Fuzz

libxml2

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: Multiple issues in libxml2

Description: A buffer overflow was addressed with improved size validation.

CVE-2020-3910: LGTM.com

Mail

Available for: macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A remote attacker may be able to cause arbitrary javascript code execution

Description: An injection issue was addressed with improved validation.

CVE-2020-3884: Apple

TCC

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A maliciously crafted application may be able to bypass code signing enforcement

Description: A logic issue was addressed with improved restrictions.

CVE-2020-3906: Patrick Wardle of Jamf

Mojave 2020-002 High Sierra 2020-002

What’s New in the macOS Catalina 10.15.4 Update (19E266)?

MrMacintosh.com - Today Apple released the macOS Catalina 10.15.4 Update (19E266). What's New? 12 New Features, 7 Resolved Issues, 20 Security Fixes & 7 Enterprise Fixes! — The macOS Catalina 10.15.4 Update is now available.

macOS Catalina 10.15.4 Update (19E266) is now Available.

10.15.4 is Catalina’s forth update, which is sometimes called the “Spring Release Update” is live! MacOS Catalina 10.15.4 is now available for download as a full installer.app, delta and combo update. Let’s take a look at the Catalina 10.15.4 Update (19E266) to see what’s new.

UPDATED: 03/26/20

10.15.4 Patch Notes Summary

12 New Features
7 Resolved Issues
20 Security Fixes
7 Enterprise Content Fixes

Apple’s Public Patch Notes / Release Notes Documentation

NOTE: Apple Documentation takes a bit to come online, I will update when the articles are posted.

developer.apple.com/documentation/macos_release_notes

developer.apple.com/documentation/macos_release_notes/macos_catalina_10_15_4_release_notes

For more detailed information about this update and previous updates, please visit: https://support.apple.com/kb/HT210642

Previous 10.15 Releases + Previous Patch Notes

10.15.4 = (19E266) March 24th 2020 = Current Release
10.15.3 = (19D76) January 28th 2020
10.15.2 = (19C57) December 10th 2019
10.15.1 = (19B2106) November 13th 2019
10.15.1 = (19B88) October 29th 2019
10.15.0 = (19A603) October 21st 2019
10.15.0 = (19A602) October 15th 2019
10.15.0 = (19A583) October 7th 2019

Catalina 10.15.4 Info & Download Links

Delta Update

Link – https://support.apple.com/kb/DL2036

Size = 2.97gb

Product ID = 061-72538

Requirements = 10.15.3

Combo Update

Link – https://support.apple.com/kb/DL2037

Size = 4.68gb

Product ID = 061-72538

Requirements = 10.15.0, 10.15.1, 10.15.2 or 10.15.3

Full Installer.app

Link – Catalina 10.15.4 Mac App Store

Size = 8.73gb

Product ID = 041-40615

Requirements – 10.15 Catalina Requirements

T2 BridgeOS Update

T2 BridgeOS was updated along with the 10.15.4 update.

BridgeOS Update = 17.16.14263

Security Content for Safari 13.1

https://support.apple.com/en-us/HT211104

New Apple Support Documents

About legacy system extensions in macOS Catalina

Some system extensions will not be compatible with a future version of macOS.

https://support.apple.com/en-us/HT210999

Prepare your Apple devices for working remotely

IT leaders can set up devices for team members to work remotely or from home.

https://support.apple.com/en-us/HT211111

Share folders with iCloud Drive

With folder sharing in iCloud Drive, you can share entire folders of files with friends, family, or colleagues. Then, you can work together on your iPhone, iPad, iPod touch, Mac, or iCloud.com.

https://support.apple.com/en-us/HT210910

If you use smart card to log in to your Mac and reset your Active Directory password from another computer

If you reset your Active Directory password from another computer and use smart card and FileVault, learn how to log in to your Mac in macOS Catalina 10.15.4 or later.

https://support.apple.com/en-us/HT211079

If Boot Camp Assistant says that your disk could not be partitioned

Boot Camp Assistant might say that an error occurred while partitioning the disk for Windows.

https://support.apple.com/en-us/HT209102

UPDATED:

If your Mac starts up to an Apple logo or progress bar

Your Mac shows an Apple logo when it finds your local startup disk, then shows a progress bar as the macOS startup or installation process continues.

https://support.apple.com/en-us/HT207019

If your macOS and iOS clients aren’t getting Apple push notifications

Learn what to do if your macOS and iOS clients don’t see Apple push notifications when connected to a network.

https://support.apple.com/en-us/HT203609

Use Apple products on enterprise networks

Learn which hosts and ports are required to use your Apple products on enterprise networks.

https://support.apple.com/en-us/HT210060

Catalina 10.15.4 Update (19E266) Overview

macOS Catalina 10.15.4 introduces iCloud Drive folder sharing, Screen Time communication limits, Apple Music time-synced lyrics view, and more. The update also improves the stability, reliability, and security of your Mac.

Finder

iCloud Drive folder sharing from Finder
Controls to limit access only to people you explicitly invite, or to grant access to anyone with the folder link
Permissions to choose who can make changes and upload files, and who can only view and download files

Screen Time

Communication limits for controlling who your children can communicate with and be contacted by throughout the day and during downtime
Playback control of music videos for your children

Music

Time-synced lyrics view for Apple Music, including the ability to jump to your favorite part of a song by clicking a line in lyrics view

Safari

Option to import Chrome passwords into your iCloud Keychain for easy AutoFill of your passwords in Safari and across all your devices
Controls for duplicating a tab and for closing all tabs to the right of the current tab
HDR playback support on compatible computers for Netflix content

App Store with Apple Arcade

Universal Purchase support enables the use of a singular purchase of a participating app across iPhone, iPod touch, iPad, Mac, and Apple TV

Pro Display XDR

Customized reference modes that you can tailor to specific workflow needs by selecting from several color gamut, white point, luminance, and transfer function options

Accessibility

Head pointer preference for moving a cursor on the screen based on the precise movements of your head

This update also includes bug fixes and other improvements:

High Dynamic Range output to HDR10-compatible third-party displays and TVs connected with DisplayPort or HDMI
OAuth authentication support with Outlook.com accounts for improved security
CalDav migration support when upgrading to iCloud reminders on a secondary device
Addresses an issue where text copied between apps may appear invisible when Dark Mode is active
Resolves an issue in Safari where a CAPTCHA tile may display incorrectly
Fixes an issue where you may receive notifications for updated or completed reminders
Fixes an issue with screen brightness for the LG UltraFine 5K display after waking from sleep

Enterprise content:

Apple Push Notification Service traffic now uses a web proxy when specified in a PAC file
Resolves an issue where updating the login keychain password after resetting a user password would cause a new keychain to be created
After enabling ”Search directory services for certificates” in Keychain Access preferences, searching by email address in Keychain Access or Mail now locates a user certificate stored in directory services
When setting the DisableFDEAutoLogin key in com.apple.loginwindow, you can now sync your FileVault password with the Active Directory user password after updating the user password
Reinstates the ability to update or restore iOS, iPadOS, or tvOS devices by dragging .ipsw files to the device in an Apple Configurator 2 window
Addresses an issue where sending the EraseDevice MDM command might not cause the device to be erased
When logging in as an Active Directory user after using deferred FileVault enablement, the user is now prompted for their password to enable FileVault

Some features may not be available for all regions, or on all Apple devices.

Security Content for 10.15.4

https://support.apple.com/en-us/HT211100

NOTE: Listed below are only security fixes for 10.15, fixes for 10.13 and 10.14 are listed in my 2020-002 security update article.

Apple HSSPI Support

Available for: macOS Catalina 10.15.3

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3903: Proteas of Qihoo 360 Nirvan Team

AppleGraphicsControl

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: Multiple memory corruption issues were addressed with improved state management.

CVE-2020-3904: Proteas of Qihoo 360 Nirvan Team

AppleMobileFileIntegrity

Available for: macOS Catalina 10.15.3

Impact: An application may be able to use arbitrary entitlements

Description: This issue was addressed with improved checks.

CVE-2020-3883: Linus Henze (pinauten.de)

Bluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3907: Yu Wang of Didi Research America

CVE-2020-3908: Yu Wang of Didi Research America

CVE-2020-3912: Yu Wang of Didi Research America

Bluetooth

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3892: Yu Wang of Didi Research America

CVE-2020-3893: Yu Wang of Didi Research America

CVE-2020-3905: Yu Wang of Didi Research America

Call History

Available for: macOS Catalina 10.15.3

Impact: A malicious application may be able to access a user’s call history

Description: This issue was addressed with a new entitlement.

CVE-2020-9776: Benjamin Randazzo (@____benjamin)

CoreFoundation

Available for: macOS Catalina 10.15.3

Impact: A malicious application may be able to elevate privileges

Description: A permissions issue existed. This issue was addressed with improved permission validation.

CVE-2020-3913: Timo Christ of Avira Operations GmbH & Co. KG

FaceTime

Available for: macOS Catalina 10.15.3

Impact: A local user may be able to view sensitive user information

Description: A logic issue was addressed with improved state management.

CVE-2020-3881: Yuval Ron, Amichai Shulman and Eli Biham of Technion – Israel Institute of Technology

Icons

Available for: macOS Catalina 10.15.3

Impact: A malicious application may be able to identify what other applications a user has installed

Description: The issue was addressed with improved handling of icon caches.

CVE-2020-9773: Chilik Tamir of Zimperium zLabs

Intel Graphics Driver

Available for: macOS Catalina 10.15.3

Impact: A malicious application may disclose restricted memory

Description: An information disclosure issue was addressed with improved state management.

CVE-2019-14615: Wenjian HE of Hong Kong University of Science and Technology, Wei Zhang of Hong Kong University of Science and Technology, Sharad Sinha of Indian Institute of Technology Goa, and Sanjeev Das of University of North Carolina

IOHIDFamily

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3919: an anonymous researcher

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3914: pattern-f (@pattern_F_) of WaCai

Kernel

Available for: macOS Catalina 10.15.3

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: Multiple memory corruption issues were addressed with improved state management.

CVE-2020-9785: Proteas of Qihoo 360 Nirvan Team

libxml2

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: Multiple issues in libxml2

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2020-3909: LGTM.com

CVE-2020-3911: found by OSS-Fuzz

libxml2

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: Multiple issues in libxml2

Description: A buffer overflow was addressed with improved size validation.

CVE-2020-3910: LGTM.com

Mail

Available for: macOS High Sierra 10.13.6, macOS Catalina 10.15.3

Impact: A remote attacker may be able to cause arbitrary javascript code execution

Description: An injection issue was addressed with improved validation.

CVE-2020-3884: Apple

sudo

Available for: macOS Catalina 10.15.3

Impact: An attacker may be able to run commands as a non-existent user

Description: This issue was addressed by updating to sudo version 1.8.31.

CVE-2019-19232

TCC

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.3

Impact: A maliciously crafted application may be able to bypass code signing enforcement

Description: A logic issue was addressed with improved restrictions.

CVE-2020-3906: Patrick Wardle of Jamf

Time Machine

Available for: macOS Catalina 10.15.3

Impact: A local user may be able to read arbitrary files

Description: A logic issue was addressed with improved state management.

CVE-2020-3889: Lasse Trolle Borup of Danish Cyber Defence

Vim

Available for: macOS Catalina 10.15.3

Impact: Multiple issues in Vim

Description: Multiple issues were addressed by updating to version 8.1.1850.

CVE-2020-9769: Steve Hahn from LinkedIn

macOS Catalina 10.15.4 Update

How To Enable the Mac Startup Chime on your 2016+ MacBook Pro!

MrMacintosh.com - With one command the Mac Startup Chime is Back!!!

A new way to bring back the Mac Startup Chime has been found!

I looking through Twitter on a normal Friday night only to see this…

STARTUP SOUND pic.twitter.com/RP2YIkAKOO
— cooldude chaysegr (@chaysegr) February 21, 2020

The Mac Startup Chime is back baby!!!!

WHAT??? Ok….. I had to immediately test this out.

Run the command below in the terminal.app

sudo nvram StartupMute=%00

Reboot

I have literally rebooted 5 MacBook Pro’s multiple times just to hear that classic sound. I could not be more happy!!!!!!!

Don’t hear the sound? Check to make sure your sound is not muted. Once you bring up the volume a bit, you will then hear the chime.

If you would like to turn this off again, run the command below.

sudo nvram StartupMute=%01

Or you can reset the PRAM

This sounds familiar…

About a month after the introduction of the 2016 MacBook Pro, someone found out that you could enable the startup sound.

https://www.macobserver.com/tips/quick-tip/reenable-macbook-pro-startup-chime/

This worked for some users but stopped working early in 2017. It’s possible that Apple disabled the old way with a firmware update.

The old command was

sudo nvram BootAudio=%01

The new command is

sudo nvram StartupMute=%00

BONG!!!!!!!!

I can’t believe it. You have to understand the emotions of a true Mac fan hearing a brand new 16″ MacBook Pro producing the startup chime. The startup chime is something that has been around since 1984. To say the chime is iconic, would be an understatement to any Mac Fan.

I tested this on at least 5 different MacBook Pro’s with different BridgeOS and T1 firmware versions.

I did find a difference, the T1 Macs have the same sound as the 2017 Macbook Air and 2016 Macbook. (The final Mac Laptops to have the sound enabled by default). The T2 sound is different, it sounds a little deeper.

I would love to find out this was a hidden easter egg for 4 years!

Was this nvram value recently added? Was it hidden in plain sight for almost 4 years? I would really like to find out. The first sighting of this seems to be a Reddit Thread from 2/20/20.

https://www.reddit.com/r/mac/comments/f6z27o/2019_16_macbook_pro_with_boot_chime_reenabled_via/

If you can find someone figuring this out before this please comment below or let me know.

Apple Removed the Startup Chime on the Redesigned 2016 15″ MacBook Pro.

When Apple removed the startup chime in 2016 most Mac fans were pretty pissed. I mean why in the heck would Apple remove it? WHY??????

https://support.apple.com/en-us/HT202768

Apple states in this article that

Mac models from early 2016 and earlier make a chime sound when they start up. Mac models from late 2016 and newer don’t have a startup chime, with the exception of MacBook Air (13-inch, 2017).
Apple.com HT202768

Jim Reekes

In the link below is an interview with James Reekes the original creator of the startup chime.

Now that there’s no startup sound, it’s like sitting down at a restaurant and there’s no one there to greet you. It just feels strange
Jim Reekes on removing the startup chime

https://9to5mac.com/2018/03/24/mac-startup-sound-creator-interview/

What’s next???

There’s only one thing left to do.

Send this command out to our entire Mac Fleet!!!

🙂

Long live the Mac Startup Chime.

How to Enable Mac Startup Sound

How to Enable Mac Startup Chime

10.15.3 Update Erases /var/log Files – System, Custom & Vendor Logs

MrMacintosh.com - The 10.15.3 Update Erases almost all of the log files in /var/log - System, Custom & Vendor Logs — The 10.15.3 Update Erases almost all of the log files in /var/log – System, Custom & Vendor Logs

The 10.15.3-10.15.6 Update Erases Almost all /var/log files

UPDATE: 09/01/20 – The problem is still in the latest build of 10.15.6.

Think about the last issue time that you had an issue and needed to troubleshoot. Right off the bat, you would start looking over the logs to pinpoint the exact point of failure. After installing the Catalina 10.15.3 Update, it’s going to be a little harder to do that. Almost all the /var/log files have been erased and start over the minute after the 10.15.3 update finished installing.

10.15.3 Update Problems

This is my 4th article on 10.15.3 Combo Update issues. If you have not seen them yet, you can view them below.

Howard Oakley over at eclecticlight.co has also been tracking multiple issues. He is focused on new 10.15.3 Time Machine Problems.

Let’s take a closer look.

What the heck is going on here? Why would Apple delete important logs? This issue is most likely a bug in the combo update installer.

The test setup is pretty straight forward.

Build out a fresh 10.15.2 system
Verify system log creation times
Create a custom .log file
Verify 3rd Party Vendor Log times
Update to 10.15.3
Find that almost all /var/log files are erased.

Which log files are erased and which ones are spared?

Erased Log Files in /var/log

System.log
WiFi.log
Jamf.log
Alf.log
fsck_apfs.log
fsck_apfs_error.log
Applefirewall.log
Cups, Bluetooth, Powermanagement & Display Policy logs

Spared Log files in /var/log

Install.log
.gz and .bz System and wifi zipped backup files

All log files have the exact “Created” date and time when the 10.15.3 combo update was installing.

MrMacintosh.com - Almost all /var/log files erased and have the same "Created time". The install.log was spared. — Almost all /var/log files erased and have the same “Created time”. The install.log was spared.

What can I do about this?

Let Apple know about this! Hopefully this can be fixed in 10.15.4!

Until then you probably want your log files. The best thing you can do for now is to run a Jamf policy that will backup your /var/log files. We install our updates with a Jamf policy.

Right before we kick off softareupdate -iaR we backup all /var/log files to a temporary directory. We put them back with a LaunchDaemon that kicks off after the combo update reboot.

I hope that these articles have helped you! If you have any questions, leave a comment below or Contact Me.

10.15.3 Combo & Security Updates are not Creating Backup Snapshots

MrMacintosh.com - 10.15.3 Combo & Security Updates no Longer Creating Restore Snapshots + 10.15.3 Update Deletes All Previous tmutil localsnapshots — 10.15.3 Combo & Security Updates are no Longer Creating Restore Snapshots + 10.15.3 Update Deletes All Previous tmutil localsnapshots /

The 10.15.3 Combo & Security Update Automatic Backup Snapshots are no Longer Created.

UPDATE: 5/15/20 – A few questions came up on MacAdmins Slack about the current state of Automatic Snapshots today. To clarify, the following is now true.

Automatic Update Snapshots are no longer automatically created during the 10.15.3+ Combo but ARE for 10.14 & 10.13 Security Updates
The 10.15.3+ Combo Update REMOVES previous manual localsnapshots.
10.14 & 10.13 Security Updates do NOT remove previous manual snapshots.
Automatic Snapshots were never taken during an OS Upgrade.

UPDATE: 4/24/20 – Apple has removed the “Restore from snapshot” feature description from apple.com/macos/catalina/features! This means that the feature is no longer available in Catalina. I really hope Apple can fix this.

The APFS Update Automatic Snapshot was a new option offered when Apple released APFS in macOS 10.13 High Sierra. If you were worried about something going wrong after installing a macOS Combo or Security update, you could always fall back to a backup taken right before the update. The process was automatic and was performed by the Combo Update and Security Update Installer. To restore, all you needed to do is, boot to the recovery partition and restore to a tmutil localsnapshot / right before the update.

NOTE: you only have 24 hours to restore or the snapshot is automatically deleted.

Apple explains how this works below.

MrMacintosh.com - Apple.com Restore from Snapshot. — apple.com/macos/catalina/features

Automatic Update Backup Snapshots are no Longer Working.

Something happened in the latest set of Apple updates released on January 28th. The Automatic Backup Snapshots are no longer working!!! At first, I thought it only happened on the 10.15.3 Combo update. I then checked the 2020-001 Security Update on High Sierra and it’s not working either!

I found this out while I was writing another article on Catalina Logs. I built a 10.15.2 device and updated it to 10.15.3. I booted to recovery to restore the from the automatic snapshot only to find that it was missing!

Manual tmutil localsnapshots are deleted during the 10.15.3 Update installation!

Ok, what would happen if I created a manual snapshot before the update? If the automatic snapshot is not working, I could get by with just creating one right before I install the 10.15.3 combo update.

MrMacintosh.com - Manual tmutil localsnapshot / created before the 10.15.3 combo update. — Manual tmutil localsnapshot / created before the 10.15.3 combo update.

After installing the 10.15.3 Combo Update, I booted back into Recovery only to find that the manual tmutil localsnapshot / that I created was gone!!!

What should happen after the update.

Below is what you should see if you booted to recovery after a combo or security update. The below example is a backup snapshot taken by the 10.14.2 Combo Update.

MrMacintosh.com - automatic update backup localsnapshot — This is what you should see if you booted to recovery after a combo or security update. (within 24 hours after the update install)

Let’s take a look at the logs

What do the logs say? Well first I would like to see what a successful snapshot says. Searching the install.log, I found exactly what I was looking for.

MrMacintosh.com - 10.14 Automatic Snapshot. — That is just what I’m looking for. The automatic snapshot was taken right before the installation.

Let’s take a closer look to see what’s happening during the 10.15.3 combo update install. Looking at the install.log again, I found this entry.

MrMacintosh.com - 10.15.3 purges localsnapshots — The 10.15.3 Combo Update purging snapshots.

There it is, the Installer is purging available snapshots on /Volumes/Macintosh HD. The 10.15.3 install.log does not contain any of the log items like the one from 10.14.

The good news is that the (2020-001) 10.14 and 10.13 Security Update installers do NOT purge your manual tmutil localsnapshots.

What’s going on, is this a bug?

I am not totally sure what’s going on here, if I had to guess this a bug. I wanted to let you know about this. The last thing you want to do is rely on that automatic backup snapshot only to find out it was never created.

Either way, please let Apple know about this!

If you have any questions or comments please Contact Me or leave a note below. Thanks!

Catalina 10.15.3 Update Reverts Custom pam.d & sshd_config Settings

MrMacintosh.com - If you set custom /etc/pam.d or sshd_config settings be sure to re apply the after the 10.15.3 update! — If you set custom /etc/pam.d or sshd_config settings be sure to re apply the after the 10.15.3 update!

If you use custom pam.d or sshd_config settings, you will need to apply them again after the 10.15.3 Update.

Apple allows us to set multiple custom settings using pam.d configuration files. We can use pam.d configuration files to set different options for, sudo, login, su, screensaver& Smart Card.

If you are looking for a good explanation on what pam.d files are, check out this link. https://www.linux.com/news/understanding-pam/

Custom /etc/pam.d Configuration Settings

The following is a few examples of what you would set in the pam.d configuration files.

/etc/pam.d/screensaver = Set the screensaver window to allow the local admin to get past the Mobile Account password lock.
/etc/pam.d/sudo = Enable smart card-only for the sudo command.
/etc/pam.d/sudo = Enable Touch ID for the SUDO command
/etc/pam.d/su = Enable smart card-only for the SU command
/etc/pam.d/login = Enable smart card-only for the LOGIN command

Custom /etc/ssh/sshd_config Settings

The same goes for the the /etc/ssh/sshd_config file. This file can be used to set custom ssh settings.

Set SSH Banner File (so ssh users see a banner warning message)
SSH HostKey Settings
SSH Logging
SSH Authentication
Kerberos Options
PAM Authentication

In comes the Catalina 10.15.3 Update, only to revert everything!

I started noticing reports of pam.d and sshd_config settings getting reverted back about a day after the 10.15.3 update went live.

For those who’ve modified /etc/pam.d/sudo to enable Touch ID for sudo auth, looks like 10.15.3 reverted this to stock.
MacAdmins user markcohen – 01/30/20

Other MacAdmins started to check and confirm that the same thing. Some of the specific settings revolved around Smart Card controls. Apple explains the Smart Card settings in the document below.

https://support.apple.com/en-us/HT208372

Allen Golbig then noted that the same thing happened to the /etc/ssh/sshd_configfile!

Is it normal for /etc/ssh/sshd_config to revert during point updates?
MacAdmins user golby – 01/31/20

The test and verification

When reporting issues like this, it’s important to verify the problem as much as possible. For this test, I built out a fresh copy of 10.15.2. I then edited the following files.

/etc/pam.d/su
/etc/pam.d/sudo
/etc/pam.d/login
/etc/pam.d/screensaver
/etc/ssh/sshd_config

I modified the files using pico and set some of the Apple recommended settings. I noted the modification date of all the files and tested to make sure the modifications worked.

I then used softwareudpate to install the 10.15.3 update.

Results

Sure enough, after the 10.15.3 update was finished, I checked the files and all 5 of them were reset back to the original modification date of

Nov 9 2019 at 4:xx AM

This problem may not be “New”

I noted in my previous article that some of the pam.d files were reverted back to stock on twitter. A few users noted that this issue is not new and has happened in previous updates. I can’t verify if this is true right now but would like to hear from you if noticed this.

I hope Apple will fix the update process so it will not revert our custom settings.

If you have noticed other custom settings that were reverted by the latest Catalina update, let me know below!

Catalina 10.15.3 Update Breaks AD Domain Users Admin & sudo Access

MrMacintosh.com - 10.15.3 Update Breaks Active Directory Domain Users Admin and sudo Access. — 10.15.3 Update Breaks Active Directory Domain Users Admin and sudo Access.

The Catalina 10.15.3 Update Breaks Active Directory Domain Users Admin and sudo Access.

The macOS Catalina 10.15.3 Update is only about two days old and is already receiving mixed reviews.

The GOOD:

The BAD:

AD Domain Users Admin Access Broken
Custom /etc/pam.d modifications reset to stock
10.15.1 Update Keychain option still broken

Have you noticed anything new that is fixed or broken in the new update? Let me know!

Active Directory Domain Admin Access Removed!

This issue was first reported in the MacAdmins Slack a few hours after the 10.15.3 update was release.

I just installed the 10.15.3 update and now I can’t admin elevate using an AD domain account. This was working this morning pre-update and nothing has changed on the AD domain.
The domain account is in a security group that is set in Directory Utility > Active Directory as allowing administration. I can authenticate with the account successfully in Terminal using su, it’s just the admin rights that are broken.
MacAdmin User aaron

A few other users started to report the same issue after Aaron did.

Let’s Examine the issue.

The issue will most likely be reported by a user who says this…

I updated to 10.15.3 and when I use sudo I get this error.
User is not in the sudoers file. This incident will be reported.
Reported to who? Am I in trouble now???
User

Let’s check to see if Active Directory Group “Domain Admins” has admin access on your Mac.

/usr/sbin/dsconfigad -show

This command will give you a list of all your Active Directory Settings.

The screenshot below is what you will see AFTER the 10.15.3 Update.

MrMacintosh.com - 10.15.3 Active Directory Domain Admins sudo problem. — The Domain Users group group was removed and is now “not set”

This is what you SHOULD see.

Quick and easy command to show just the Allowed admin groups value.

/usr/sbin/dsconfigad -show | /usr/bin/awk -F= '/Allowed admin groups/ { print $2 }' | /usr/bin/awk '{$1=$1};1'

HT goes out to Eric Holtam (@eholtam) for the command!

You could still have the issue even if “Allowed admin groups” shows domain admins.

In one of my tests to confirm this issue after the 10.15.3 update finished, I still had the domain admins group but my admin access did not work.

Do you use a custom Active Directory Admin Global Group ?

What if you use a custom AD group like “Pretendo_Admins” ?

You can have the same issue.

I did not have this issue after updating

Did you use a profile to bind? This is one example that I was unable to test.

Was the Mac connected to your directory for a few hours -1 day ? See Fix #3 below, it’s possible that the AD connector refreshed your information.

How can I fix this Problem?

The issue can be fixed in 3 ways.

Re-Bind to Active Directory
Run dsconfigad to set the group access again
WAIT – It was reported that the issue is fixed automatically after the Mac is left online for a certain amount of time. The configuration is refreshed. – Thanks to MacAdmins user awickert for testing this out.

To reset the domain group setting run this command.

dsconfigad -groups "DOMAIN\domain admins"

NOTE: If you use a custom AD Global group for admin adccess you need to replace domain admins with your custom group.

dsconfigad -groups "DOMAIN\Pretendo_Admins"

You can now run dsconfgad -show then check the Allowed admin groups and it should say = domain admins or your custom group.

You can also run this command to double verify the user now has admin access. (Thank you to a well known MacAdmins wizard for this command)

dsmemberutil checkmembership -U USERNAMEHERE -G admin

If the command worked you will see

user is a member of the group

If not, you will see

user is not a member of the group

MacOS Security Updates – Mojave 2020-001 & High Sierra 2020-001

On January 28th, Apple released macOS Mojave Security Update 2020-001 and High Sierra Security Update 2020-001. Below you will find Build Versions, Download Links, Update Sizes and previous Security Update Links. MacOS Sierra is no longer supported.

How do I keep track of all the macOS Build Versions?

I document all of the macOS Build Versions like the latest Mojave 2020-001 High Sierra 2020-001 along with most Apple Applications, XProtect, Gatekeeper and MRT updates in one database. You can check out the link below.

mrmacintosh.com/macos-system-status-version-info-for-macadmins/

MacOS Mojave Security Update 2020-001 (18G3020)

macOS Mojave Security Update 2020-001
Size = 1.62gb
Package Download and Information Link
https://support.apple.com/kb/DL2031

Information on the Security fixes included in the 2020-001 Mojave Security Update

https://support.apple.com/en-us/HT210919

HT goes out to Dan Kuehling, for the Mojave Security Update Build Version! HT goes out to Nicolas Aragone, Ian Trimnell & Joost-Wim for sending over the Security Update Download Links!

MacOS High Sierra Security Update 2020-001 (17G11023)

10.13.6 High Sierra Security Update 2020-001 (17G11023)
Size = 1.92gb
Package Download and Information Link
https://support.apple.com/kb/DL2032

Information on the Security fixes included in the 2020-001 High Sierra Security Update

https://support.apple.com/en-us/HT210919

Safari Update

Safari was updated to version 13.0.5

Download Size for High Sierra = 67.9

Downloads Size for Mojave = 68.9

T2 BridgeOS Update

Both the 2020-001 and 2020-001 Security Updates upgrade BridgeOS to version – 17.16.13050

Previous Releases

Security Related Content for 2020-001

19 – Security Content Related Fixes for 10.14 and 10.13

apache_mod_php

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Multiple issues in PHP

Description: Multiple issues were addressed by updating to PHP version 7.3.11.

CVE-2019-11043

CoreBluetooth

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab

CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab

CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab

CoreBluetooth

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab

Crash Reporter

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to access restricted files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3835: Csaba Fitzl (@theevilbit)

Image Processing

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3827: Samuel Groß of Google Project Zero

ImageIO

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3826: Samuel Groß of Google Project Zero

CVE-2020-3870

CVE-2020-3878: Samuel Groß of Google Project Zero

Intel Graphics Driver

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A type confusion issue was addressed with improved memory handling.

CVE-2020-3853: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to determine kernel memory layout

Description: An access issue was addressed with improved memory management.

CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3842: Ned Williamson working with Google Project Zero

CVE-2020-3871: Corellium

libxml2

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow was addressed with improved size validation.

CVE-2020-3846: Ranier Vilela

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted string may lead to heap corruption

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3856: Ian Beer of Google Project Zero

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to gain elevated privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-3829: Ian Beer of Google Project Zero

PackageKit

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to overwrite arbitrary files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3830: Csaba Fitzl (@theevilbit)

sudo

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Certain configurations may allow a local attacker to execute arbitrary code

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2019-18634: Apple

System

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6

Impact: A malicious application may be able to overwrite arbitrary files

Description: An access issue was addressed with improved access restrictions.

CVE-2020-3855: Csaba Fitzl (@theevilbit)

Wi-Fi

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3843: Ian Beer of Google Project Zero

wifivelocityd

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: The issue was addressed with improved permissions logic.

CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Mojave 2020-001 High Sierra 2020-001

What’s New in the macOS Catalina 10.15.3 Update (19D76)?

macOS Catalina 10.15.3 Update (19D76) is now Available.

10.15.3 is Catalina’s third update and was released about a month and a half after the 10.15.2 Update. MacOS Catalina 10.15.3 is now available for download as a full installer.app, delta and combo update. Let’s take a look at the Catalina 10.15.3 Update (19D76) to see what’s new.

10.15.3 Patch Notes Summary

1 Known Issue
1 Undocumented Fix
2 Resolved Issues
EDIT: 23 Security Fixes

Apple’s Public Patch Notes / Release Notes Documentation

developer.apple.com/documentation/macos_release_notes

developer.apple.com/documentation/macos_release_notes/macos_catalina_10_15_3_release_notes

For more detailed information about this update and previous updates, please visit: https://support.apple.com/kb/HT210642

Previous 10.15 Releases + Previous Patch Notes

10.15.3 = (19D76) January 28th 2020 = Current Release
10.15.2 = (19C57) December 10th 2019
10.15.1 = (19B2106) November 13th 2019
10.15.1 = (19B88) October 29th 2019
10.15.0 = (19A603) October 21st 2019
10.15.0 = (19A602) October 15th 2019
10.15.0 = (19A583) October 7th 2019

Catalina 10.15.3 Info & Download Links

Delta Update

Link – https://support.apple.com/kb/DL2029

Size = 2.99gb

Product ID = 061-62842

Requirements = 10.15.2

Combo Update

Link –https://support.apple.com/kb/DL2030

Size = 4.59gb

Product ID = 061-62853

Requirements = 10.15.0, 10.15.1 or 10.15.2

HT to Howard Oakley for the download links!!

https://eclecticlight.co/2020/01/28/apple-has-released-macos-catalina-10-15-3-and-security-updates-for-mojave-and-high-sierra/

Full Installer.app

Link – Catalina 10.15.3 Mac App Store

Size = 8.67gb

Product ID = 061-44387

Requirements – 10.15 Catalina Requirements

T2 BridgeOS Update

T2 BridgeOS was updated along with the 10.15.3 update.

BridgeOS Update = 17.16.13050

Catalina 10.15.3 Update (19D76) Overview

The macOS Catalina 10.15.3 update improves the stability, reliability and security of your Mac, and is recommended for all users.
This update:

Optimizes gamma handling of low gray levels on Pro Display XDR for SDR workflows when using macOS
Improves multi-stream video editing performance for HEVC and H.264 encoded 4K video on the 16-inch MacBook Pro (2019)

Undocumented Fix – Mail.app Data loss bug is reportedly fixed.

https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-10-15/

Security Content for 10.15.3

https://support.apple.com/en-us/HT210919

EDIT: removed 4 10.14 and 10.13 only fixes = 23 Security Content Related Fixes

AnnotationKit

Available for: macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3877: an anonymous researcher working with Trend Micro’s Zero Day Initiative

apache_mod_php

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Multiple issues in PHP

Description: Multiple issues were addressed by updating to PHP version 7.3.11.

CVE-2019-11043

Audio

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team

autofs

Available for: macOS Catalina 10.15.2

Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper

Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share.

CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka)

Crash Reporter

Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to access restricted files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3835: Csaba Fitzl (@theevilbit)

Image Processing

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3827: Samuel Groß of Google Project Zero

ImageIO

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted image may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-3826: Samuel Groß of Google Project Zero

CVE-2020-3870

CVE-2020-3878: Samuel Groß of Google Project Zero

Intel Graphics Driver

Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team

IOAcceleratorFamily

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3837: Brandon Azad of Google Project Zero

IPSec

Available for: macOS Catalina 10.15.2

Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution

Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking.

CVE-2020-3840: @littlelailo

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel

Available for: macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A type confusion issue was addressed with improved memory handling.

CVE-2020-3853: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to determine kernel memory layout

Description: An access issue was addressed with improved memory management.

CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3842: Ned Williamson working with Google Project Zero

CVE-2020-3871: Corellium

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Processing a maliciously crafted string may lead to heap corruption

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3856: Ian Beer of Google Project Zero

libxpc

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to gain elevated privileges

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2020-3829: Ian Beer of Google Project Zero

PackageKit

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A malicious application may be able to overwrite arbitrary files

Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.

CVE-2020-3830: Csaba Fitzl (@theevilbit)

Security

Available for: macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg

sudo

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: Certain configurations may allow a local attacker to execute arbitrary code

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2019-18634: Apple

Wi-Fi

Available for: macOS Catalina 10.15.2

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro’s Zero Day Initiative

Wi-Fi

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory

Description: A memory corruption issue was addressed with improved input validation.

CVE-2020-3843: Ian Beer of Google Project Zero

wifivelocityd

Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2

Impact: An application may be able to execute arbitrary code with system privileges

Description: The issue was addressed with improved permissions logic.

CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Internet Recovery, Recovery Partition or HW Diag from macOS

MrMacintosh.com - Boot to Internet Recovery, Recovery Partition or Diagnostics from macOS using nvram or Recovery Selector.app — Boot to Internet Recovery, Recovery Partition or Diagnostics from macOS using nvram or Recovery Selector.app

How to Boot to Internet Recovery, Recovery Partition or Diagnostics from inside macOS.

UPDATE 01/25/21 – Martin Nobel @martinnobel_ – If you want to make an Intel Mac boot into the Startup Manager automatically, type into terminal: “Sudo nvram manufacturing-enter-picker=true”

This means that we can boot to almost every single recovery mode EXCEPT for Internet Recovery!

When an undocumented macOS command or option is discovered, the MacAdmin community gets pretty excited. This is one of those times, as a new nvram key and value was uncovered over the weekend.

If you need to boot to Internet Recovery, you first need to remember the Mac Boot Up Keyboard Combination. Can you remember all of them? I can’t and I work on this stuff every day! Below is the complete list Mac Startup Key Combinations. The second article adds two additional keyboard combinations bringing the total to twelve! The first one will “Reinstall the macOS that came with your Mac, or the closest version still available.” The second command will “Upgrade to the latest macOS that is compatible with your Mac.”

Apple Document – Mac startup key combinations https://support.apple.com/en-us/HT201255

Apple Document – macOS Recovery installs different versions of macOS https://support.apple.com/en-us/HT204904

Undocumented command found that allows you to boot almost all available recovery options from macOS.

Over the weekend Tim Perfitt (founder and CEO of Twocanoes Software, Inc) tweeted this out to his followers.

I made a free & open source macOS app to select your recovery partition on next reboot. Download here: https://t.co/GSSkQgl8c7 #macadmins pic.twitter.com/DgHYrzR4ZS
— timo (@tperfitt) January 25, 2020

Tim, announcing the first version of Recovery Selector.app that could boot to the Recovery Partition from macOS.

Tim found an undocumented nvram command that you could use to boot your Mac to the Recovery Partition from macOS! From there, he had an idea to create an open source app that would allow you to boot to the Recovery Partition without knowing the exact command.

Someone found additional nvram keys and values!

I replied to Tim’s tweet letting him know that I put in an Apple Enterprise Support ticket to see if we could uncover if an Internet Recovery key existed. Before I could hear back from support, someone found and sent the new key internet-recovery-mode over to Tim. He then improved the app allowing you to boot into four different modes!

Nvram Keys and Values

The commands that we needed are set with two different keys and four different values.

The new values and keys are

recovery-boot-mode = Local Recovery Partition Value
unused Boot to Recovery Partition

internet-recovery-mode = Internet Recovery Value
RecoveryModeNetwork Internet Recovery (Shift-Option-⌘-R)
RecoveryModeDisk Recovery Partition (⌘- R)
DiagsModeDisk Boot to Local Apple Hardware Diagnostic (D)
DiagsModeNetwork Boot to Internet/AST Diagnostic (Option-D)

Let’s put it all together, keep in mind you must run the nvram as an administrator.

sudo nvram internet-recovery-mode=RecoveryModeNetwork

sudo reboot

MrMacintosh.com - All four different nvram internet-recovery-mode values and keys — All four different nvram internet-recovery-mode values and keys

Your Mac will immediately reboot and start up in Internet Recovery Mode.

Compatibility, Caveats and Requirements

UPDATE 01/27/20

I tested the above commands with the following hardware and OS versions.

2018 T2 15″ MacBook Pro = 10.15.3 Beta 2
2016 13″ MacBook Pro = 10.14.6
2010 13″ MacBook Air = 10.13.6

This should confirm that the command works from 10.13.6-10.15.3 and on Mac Hardware from 2010-2019.

Network Requirements (For Internet Boot Options)

Wired Ethernet Connection
Wifi = Any WPA2 saved connection.
WPA2 Enterprise WIFI is NOT Supported

The WiFi network Internet Recovery will the Top “Preferred Network” listed to boot to Internet Recovery. If for some reason the Mac can’t connect to that network you will be prompted in firmware to connect to a different WiFi network or ethernet network.

Boot Security Requirements

Firmware Password Protection – can be ON or OFF. If ON then you will be required to enter in the firmware password.
Secure Boot – can enabled , the commands works fine.
FileVault – can be enabled, you do not have to enter in your FV2 password.

Restart Requirements

You do not have to reset the boot disk, clear out nvram commands or reset anything. When you restart the Mac, it will boot right back into macOS.

Twocanoes Recovery Selector.app = Easy Mode!!!

Are you going to remember all of the different nvram keys and values?

Probably not

Why not use one simple open source application to do this for you?

In comes the Recovery Selector.app

MrMacintosh.com - Recovery Selector.app — Recovery Selector.app menu = easy mode for your test Mac or VM!

Tim had the great idea to take all the above command options and put them into one application. Two clicks gets your Mac rebooted to the Recovery Partition, Internet Recovery, Local HW Diagnostics or Internet HW Diagnostics.

Note: Admin access to reboot is not required, the app uses a LaunchDaemon.

You can download and try Recovery Selector.App below.

https://bitbucket.org/twocanoes/recovery-selector/downloads/

UPDATE 01/27/20

Tim put together a nice youtube video showing the process.

https://www.youtube.com/watch?v=fS2s8TY1mrQ

We are only missing one critical nvram Internet Recovery Value.

We are only one nvram value away from perfect.

Option-⌘-R

“Upgrade to the latest macOS that is compatible with your Mac.“

I am going to change my Apple Enterprise Support ticket into an Enhancement Request. If this final value is added we will have all 5 boot modes available in macOS.

If you have any questions please comment below or Contact Me!