Cyber Security

Unpatched High-Severity Vulnerability Affects Apple macOS Computers

Cybersecurity researchers on Tuesday disclosed details of an unpatched vulnerability in macOS Finder that could be abused by remote adversaries to trick users into running arbitrary commands on the machines.

“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands, these files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user,” SSD Secure Disclosure said in a write-up published today.

Park Minchan, an independent security researcher, has been credited with reporting the vulnerability which affects macOS versions of Big Sur and prior.

The weakness arises due to the manner macOS processes INETLOC files — shortcuts to internet locations such as RSS feeds or Telnet connections containing username and password for SSH — resulting in a scenario that allows commands embedded in those files to be executed without any warning.

Prevent Data Breaches

“The case here INETLOC is referring to a ‘file://’ protocol which allows running locally (on the user’s computer) stored files,” SSD said. “If the INETLOC file is attached to an email, clicking on the attachment will trigger the vulnerability without warning.”

Although newer versions of macOS have blocked the ‘file://’ prefix, using ‘File://’ or ‘fIle://’ has been found to circumvent the check effectively. We have reached out to Apple, and we will update the story if we hear back.

Products You May Like

Articles You May Like

Cloud stocks are rallying after a punishing start to the year as 2022 outlook brightens
US Gunman Posted ‘Call to Arms’ on Truth Social After FBI Searched Donald Trump’s Home: Reports
Garmin Enduro 2 With Up to 46 Days of Battery, Rugged Design Launched for Athletes
From Fashion to Fitness, How Smartwatches Are Growing in Popularity in India
Samsung Galaxy Watch 5, Galaxy Watch 5 Pro Price in India Revealed; Pre-Bookings Start August 16

Leave a Reply

Your email address will not be published.