New OS X 10.10.5 Privilege Escalation Vulnerability Discovered - اخبار التقنية

ahlam1399 · #1 08-18-2015, 04:05 AM

New OS X 10.10.5 Privilege Escalation Vulnerability Discovered

Just days after Apple *****ed the DYLD_PRINT_TO_FILE security hole with the release of OS X 10.10.5, a developer has found a similar un*****ed exploit that could allow attackers to gain root-level access to a Mac.

Luca Todesco shared information (via AppleInsider) on the "tpwn" exploit on GitHub over the weekend. It affects all versions of OS X Yosemite, including OS X 10.10.5, but does **t affect OS X El Capitan.

10.10.5 Privilege Escalation Vulnerability Discovered

Todesco did **t give Apple a heads up on the Vulnerability before sharing it publicly, so it is **t clear when Apple will release a ***** for machines running OS X Yosemite. As **ted by AppleInsider, it is standard procedure (and a courtesy) for security researchers and developers to provide Apple with details on vulnerabilities before publicizing them to prevent ******s from using security holes for nefarious purposes.

According to Todesco, who has also shared what he says is a third-party fix, releasing details on the exploit is ** different than releasing an iOS jailbreak, but as Engadget explains, Todesco's actions have the potential to be somewhat more harmful than a jailbreak.

Those are technically true, but they downplay the practical dangers of publishing this info. Many people aren't k**wledgeable e**ugh to try third-party safeguards or deal with the possible side effects, and jailbreaks are at least intended for semi-in**cuous purposes. A 'surprise' exploit for the Mac only really serves to give attackers time that they wouldn't otherwise have.

It took Apple less than a month to release OS X 10.10.5 to fix the DYLD_PRINT_TO_ACCESS Vulnerability after it was first publicized, but during the time between its discovery and the launch of the fix, an exploit using the Vulnerability was discovered in the wild.

Ahead of a fix for this latest vulnerability, OS X Yosemite users can protect themselves by downloading apps solely from the Mac App Store and from trusted developers.