Month of Apple Bugs project uncovers vulnerability in flaw-fixing tool
686 views 
A vulnerability has been discovered in a tool used to patch bugs found in Apple software. The flaw was disclosed earlier this week as part of the Month of Apple Bugs (MoAB) project. The two men behind the project, Kevin Finisterre and a former hacker known as LMH, aim to publicize bugs in Apple's OS X operating system throughout January and produce working code for any loopholes they find.
The latest vulnerability is in Application Enhancer (APE), used to apply run-time patches for published Apple flaws.
The bug allows local users to obtain root privileges - and possibly compromise a computer - by patching or replacing the APE binary code.
Not quite
APE is being used right now to apply patches, yes. But lead people to assume this is the purpose of APE - that's about as misleading as you can get. So far APE itself is far more dangerous than any of the bugs it's been set to patch.
Post new comment