Article 5PVEF Unpatched MacOS vulnerability lets remote attackers execute code

Unpatched MacOS vulnerability lets remote attackers execute code

by
Ax Sharma
from Ars Technica - All content on (#5PVEF)
dmitry-chernyshov-mP7aPSUm7aE-unsplash-8

Enlarge (credit: Dmitry Chernyshov)

A code execution bug in Apple's macOS allows remote attackers to run arbitrary commands on your device. And the worst part is, Apple hasn't fully patched it yet, as tested by Ars.

Those shortcut files can take over your Mac

Independent security researcher Park Minchan has discovered a vulnerability in the macOS that lets threat actors execute commands on your computer. Shortcut files that have the inetloc extension are capable of embedding commands inside. The flaw impacts macOS Big Sur and prior versions.

"A vulnerability in the way macOS processes inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning / prompts," explains Minchan. "Originally, inetloc files are shortcuts to an Internet location, such as an RSS feed or a telnet location; and contain the server address and possibly a username and password for SSH and telnet connections; can be created by typing a URL in a text editor and dragging the text to the Desktop."

Read 10 remaining paragraphs | Comments

index?i=NCahjsTYbp8:uUyCubF1chE:V_sGLiPB index?i=NCahjsTYbp8:uUyCubF1chE:F7zBnMyn index?d=qj6IDK7rITs index?d=yIl2AUoC8zA
External Content
Source RSS or Atom Feed
Feed Location http://feeds.arstechnica.com/arstechnica/index
Feed Title Ars Technica - All content
Feed Link https://arstechnica.com/
Reply 0 comments