Worth noting and passing on to other MacOS users.
A security researcher has published attack code for an unpatched flaw in Mac OS X, the latest vulnerability in the “Month of Kernel Bugs” campaign.
The proof-of-concept code exploits a security hole in the way Apple Computer’s operating system handles disk image files, the researcher wrote Monday on a blog devoted to the campaign, which promises to reveal details of a new flaw in low-level software every day this month.
“Mac OS X com.apple.AppleDiskImageController fails to properly handle corrupted DMG (disk image) image structures, leading to an exploitable memory corruption condition with potential kernel-mode arbitrary code execution by unprivileged users,” wrote the researcher, who goes by the initials “LMH.”
The vulnerability could be exploited remotely, as Apple’s Safari Web browser loads DMG files from external sources, such as one found while visiting an URL, LMH wrote. That could let an outsider compromise a system. [cnet]
To put it into simple terms, there is a risk, but you have to actively download a file from the Internet for anything “bad” to happen. Nothing happens from just having your computer connected to a network. I’m sure Apple will attempt to fix this in the very near future.
Just be smart with what you are doing. Don’t download anything you can’t be really sure of. If a website that you visit automatically has a file start downloading onto your computer, stop it as soon as you can. If it gets downloaded anyway, do not allow it to expand or activate. Cancel anything your browser asks, and do not double click on the file itself. Delete it as soon as possible.
