A security researcher has posted proof-of-concept code for a 'highly critical' vulnerability in Apple's OS X operating system.
The exploit targets a component used to run Apple's .dmg disk images files. The .dmg format is commonly used to compress programs for download and is similar to the .iso format used in Windows.
A security researcher using the initials 'LMH' posted details about the vulnerability as part of the Month of Kernel Bugs project.
The author claimed that the exploit could easily be executed in Apple's Safari web browser through a specially crafted .dmg file launched when a user visits a webpage.
According to LMH, the threat can be mitigated in Safari by disabling a setting in the browser's preference panel that reads 'Open 'safe' files after downloading.'
Disabling the setting will prevent .dmg files, images, movies and PDF files from automatically opening after they have been downloaded.
Security firm Secunia rates the vulnerability as 'highly critical', its second-highest threat level. It is the highest alert level given to a Mac OS X vulnerability since the publication of an official Apple security update in early October.
The Month of Kernel Bugs project has vowed to post new proof-of-concept or exploit code every day for the entire month of November.
Apple did not respond to a request for comment.
New exploit published for Mac OS X
By
Shaun Nichols
on Nov 23, 2006 9:54AM
