By Tom Espiner, 27 November 2006 08:50
NEWS
The US government has added its weight to warnings about a vulnerability in Apple Mac OS X.
Security from A to Z
Click on the links below to find out more...
A is for Antivirus
B is for Botnets
C is for CMA
D is for DDoS
E is for Extradition
F is for Federated identity
G is for Google
H is for Hackers
I is for IM
J is for Jaschan (Sven)
K is for Kids
L is for Love Bug
M is for Microsoft
N is for Neologisms
O is for Orange
P is for Passwords
Q is for Questions
R is for Rootkits
S is for Spyware
T is for Two-factor authentication
U is for USB sticks/devices
V is for Virus variants
W is for Wi-fi
X is for OS X
Y is for You
Z is for Zero-day
The US computer emergency response team (US-Cert) issued an alert last week, reporting a failure in the way OS X handles corrupted disk image files - for Macs, the '.dmg' file format.
A disk image file is a digital representation of the contents and structure of a storage device like a CD or DVD. According to US-Cert, the vulnerability in OS X may allow an attacker using malformed '.dmg' files to corrupt system memory in a way that could allow arbitrary code execution, or cause a denial of service.
The researcher who found the vulnerability claimed it is remotely exploitable as Apple's Safari browser can be set to automatically open '.dmg' files downloaded from external sources. According to the researcher, this can be prevented by changing the browser preferences and deactivating the functionality for opening "safe" files after downloading.
However, the US-Cert vulnerability note said the organisation was "currently unaware of a practical solution to this problem".
Tom Espiner writes for ZDNet UK
Comments
There are 2 comments. Join the discussion
1. Don Tregartha
But don't forget the OS requires explicit permission from the root user to install anything in the root directory.
Now that won't stop somebody with suuficient access rights from putting in their password, but not everyone in the Mac world is THAT daft.
What won't happen is the OS automatically stuffing malware all over the system.
2. Steven Fisher
No, Don, it doesn't. Once code is running as root it's all over for Mac OS X's security model. Unfortunate but true.