Technology news and Jobs 
Information Technology News Mac OS X critical flaw exploit published
Information Technology News Mac OS X critical flaw exploit published | Mac OS X critical flaw exploit published |
|
| by Stan Beer | |
| Wednesday, 22 November 2006 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
The security researcher who discovered the flaw uses the acronym LMH and reports: "Mac OS X com.apple.AppleDiskImageController fails to properly handle corrupted DMG image structures, leading to an exploitable memory corruption condition with potential kernel-mode arbitrary code execution by unprivileged users. "This issue is remotely exploitable as Safari loads DMG files from external sources (ex. visiting an URL). This can be prevented by changing the Preferences and deactivating the functionality for 'opening "safe" files after downloading'. "Right now, Apple doesn't provide a public specification for the DMG format, nor source and/or API reference for com.apple.AppleDiskImageController. Although, the binary-form code can be found at /System/Library/Extensions/IOHDIXController.kext/Contents/MacOS/IOHDIXController." Danish security researcher Secunia, which has previously been busy unveiling flaws in IE7, rates the currently unpatched Mac OS X flaw as highly critical, meaning a remote user can gain control of an affected system. Apple has yet to issue a statement concerning the flaw. {moscomment} |
Tags
| < Next story in category | Previous story in the category > |
|---|
