Feeds

Apple patches critical Mac OS X hole

'Theoretical vulnerability'

  • alert
  • submit to reddit

Top three mobile application threats

Apple Computer on Friday (21 May) issued a patch for a security hole in Mac OS X that could have allowed hackers to take over vulnerable machines, but the company went out of its way to downplay the importance of the bug.

The vulnerability in the operating system's Help View application allows attackers to craft a special URL that will execute any application, command or script on the victim's computer. To be hit by the bug, a user would have to visit a malicious website, or be lured by e-mail into following the URL. The bug works on most browsers, including Internet Explorer for Mac, Mozilla and Apple's Safari.

The hole was discovered by a German techie called "Lixlpixel," who claims to have reported the bug to Apple on February 23rd. It wasn't until nearly three months passed without any response from the Cupertino, Calif. computer maker that Lixlpixel went public with the hole, when discussions about it began showing up in online forums, he says. Security services firm Secunia confirmed the vulnerability and released a formal advisory on Monday. Secunia rates the bug "extremely critical."

In a statement issued along with the patch Friday, Apple called the hole a "theoretical vulnerability" that never placed customers at risk.

"Apple takes security very seriously and works quickly to address potential threats as we learn of them -- in this case, before there was any actual risk to our customers," said Apple's senior vice president Philip Schiller. "While no operating system can be completely immune from all security issues, Mac OS X's UNIX-based architecture has so far turned out to be much better than most."

The bug is easy to use, and benign demonstration scripts are freely available online. But Lixlpixel said in an email interview he's not aware of anyone having wielded it maliciously. "As far as I know there is not one single report of an exploit," he wrote.

Mac OS X users can install the patch through Apple's Software Update service, or through Apple's support website.

Copyright © 2004, SecurityFocus logo

Related stories

Windows-style security hell stalks Mac OS X? Yeah, you wish
Vuln exposes soft underbelly of Mac OS X
Buggy software on the rise

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.