US govt warns of Apple flaw
The U.S. Government has added its weight to warnings about a vulnerability in Apple Mac OS X.
The U.S. computer emergency response team (US-CERT) issued an alert on Thursday, reporting a failure in the way OS X handles corrupted disk image files--for Macs, the .dmg file format. CNet News.com first reported the vulnerability on Tuesday.
A disk image file is a digital representation of the contents and structure of a storage device like a CD or DVD. According to US-CERT, the vulnerability in OS X may allow an attacker using malformed .dmg files to corrupt system memory in a way that could allow arbitrary code execution, or cause a denial of service.
The news of the vulnerability has caused fierce debate among Mac supporters and detractors. Various CNet News.com readers were incensed that the vulnerability had been reported as remotely exploitable, reasoning that to download a .dmg file would require user interaction.
The researcher who found the vulnerability claimed it is remotely exploitable as Apple's Safari browser can be set to automatically open .dmg files downloaded from external sources. The researcher claimed this can be prevented by changing the browser preferences and deactivating the functionality for opening "safe" files after downloading.
However, the US-CERT vulnerability note said the organization was "currently unaware of a practical solution to this problem."