6 ms·

So we currently have 2 local privilege escalation exploits [1] available for Mac OSX. Apple appears to be in no rush to fix the first one, I wouldn't bet my mon

by Mojah 11y ago

So we currently have 2 local privilege escalation exploits [1] available for Mac OSX. Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ... [1] http://bit.ly/1MrsdID http://bit.ly/1MrsdID

MagerValp 11y ago
The DYLD_PRINT_TO_FILE exploit was fixed in 10.10.5.
- pacquiao882 11y ago
  It was not fixed. There are currently no plans to fix it in 10.10. https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file-exploit-found-in-the-wild/ https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file...
  - MagerValp 11y ago
    That article is two weeks old. 10.10.5 was released 3 days ago, and the fix is mentioned in the release notes (under dyld): https://support.apple.com/en-us/HT205031 https://support.apple.com/en-us/HT205031
klapinat0r 11y ago
One of the vulns in this exploit is fixed, rendering the exploit "useless" in 10.11. But start the mac hate train regardless - if facts don't count :)
- klapinat0r 11y ago
  Why the massive downvotes when contributing to the issue he raises? > Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ... As it was clearly stated, there is a fix. Whether or not they'll release a 10.10 patch remains to be shown, and "no rush" is speculation. I'll never understand the HN crowd, but I guess providing additional information to clear up a false statement, while correcting OPs assumptions is against the rules.
  - Arkanta 11y ago
    >Whether or not they'll release a 10.10 patch remains to be shown 10.10.3, which includes that fix, was released 3 days ago. I'll never understand the HN crown, whining about the HN crowd while you didn't bother googling before writing your rant.
    - klapinat0r 11y ago
      I'm sorry, where's the rant? I didn't know there was a 10.10.3 patch - I never said there wasn't. OP said there wasn't, I said it remains to be shown. You're more than welcome to correct me on that. I don't understand what my patch sentence has to do with whining - or how that is whining about the HN crowd? It's still unclear what was unwanted about my original comment, so I can't really correct my behavior (which was what I wanted all along).
Osmium 11y ago
They've released a fix for the DYLD bug, and it didn't effect El Capitan anyway. Point of interest, but I had manually changed my sudoers file when I was running Yosemite. I'm now running the El Capitan beta. The sudoers file had been happily unchanged up until the most recent update, when it was reset... I don't know if it's related to concerns over the DYLD bug, but I'm guessing it is. It's encouraging that of these two major bugs, both didn't work in El Capitan. Not claiming that it's going to be some sort of panacea; I'm sure it's just a matter of time before it gets exploited too. But it's still encouraging.

by Mojah 11y ago

MagerValp 11y ago

The DYLD_PRINT_TO_FILE exploit was fixed in 10.10.5.

pacquiao882 11y ago
It was not fixed. There are currently no plans to fix it in 10.10. https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file-exploit-found-in-the-wild/ https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file...
- MagerValp 11y ago
  That article is two weeks old. 10.10.5 was released 3 days ago, and the fix is mentioned in the release notes (under dyld): https://support.apple.com/en-us/HT205031 https://support.apple.com/en-us/HT205031

klapinat0r 11y ago

One of the vulns in this exploit is fixed, rendering the exploit "useless" in 10.11. But start the mac hate train regardless - if facts don't count :)

klapinat0r 11y ago
Why the massive downvotes when contributing to the issue he raises? > Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ... As it was clearly stated, there is a fix. Whether or not they'll release a 10.10 patch remains to be shown, and "no rush" is speculation. I'll never understand the HN crowd, but I guess providing additional information to clear up a false statement, while correcting OPs assumptions is against the rules.
- Arkanta 11y ago
  >Whether or not they'll release a 10.10 patch remains to be shown 10.10.3, which includes that fix, was released 3 days ago. I'll never understand the HN crown, whining about the HN crowd while you didn't bother googling before writing your rant.
  - klapinat0r 11y ago
    I'm sorry, where's the rant? I didn't know there was a 10.10.3 patch - I never said there wasn't. OP said there wasn't, I said it remains to be shown. You're more than welcome to correct me on that. I don't understand what my patch sentence has to do with whining - or how that is whining about the HN crowd? It's still unclear what was unwanted about my original comment, so I can't really correct my behavior (which was what I wanted all along).

Osmium 11y ago

They've released a fix for the DYLD bug, and it didn't effect El Capitan anyway. Point of interest, but I had manually changed my sudoers file when I was running Yosemite. I'm now running the El Capitan beta. The sudoers file had been happily unchanged up until the most recent update, when it was reset... I don't know if it's related to concerns over the DYLD bug, but I'm guessing it is. It's encouraging that of these two major bugs, both didn't work in El Capitan. Not claiming that it's going to be some sort of panacea; I'm sure it's just a matter of time before it gets exploited too. But it's still encouraging.