Vulnerability found in tool used to fix Apple bugs

By

A vulnerability has been discovered in a tool used to patch bugs found in Apple software.

Vulnerability found in tool used to fix Apple bugs
The flaw was detected earlier this week by researchers as part of the Month of Apple Bugs project. The two men behind the project, Kevin Finisterre and a former hacker known as LMH, aim to publicise bugs in Apple's OS X operating system throughout January and produce working code used to exploit any loopholes they find.

The latest vulnerability is in a piece of software called Application Enhancer (APE), used to apply run-time patches to the published Apple flaws.

The bug allows local users to obtain root privileges in the system by patching or replacing the APE binary and enables the user to compromise the computer.

Finisterre described APE as "flawed" in his blog. However, software engineer Landon Fuller, who vowed to provide fixes to the flaws using the appliance, said it was only a proof-of-concept bug.

"The vulnerability is real, it is possible for a local administrator account on the computer to gain root access, without any user confirmation by replacing pieces of APE's installation," he said in his blog.

"While this cannot be exploited remotely, it could be used in combination with a remote exploit to acquire escalated privileges. However, a remote exploit alone is sufficient to allow an attacker full access to your important personal data."
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?