3 ms·

Could anyone summarize the implications of this finding in plain English?

• kalleboo 12y ago
  Any code running as any user on an unpatched version can become root (and do whatever it wants, E.g. install keyloggers) Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.
  • kybernetyk 12y ago
    >Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure. Just tried. Sandbox lets this through. (As long as you pass nil to authenticateUsingAuthorizationSync:).
    • 72deluxe 12y ago
      Ouch.
• maqr 12y ago
  Sometimes these things are easier to explain if you look at it like an attacker: If you're a regular user of an OSX system before 10.10.3, and you want to become root (admin user), you can use this exploit to become root. If you're an author of malicious OSX software, and a user without admin permissions installs your malware, you can use this exploit to make your malware run as root. Once you have root, you can do anything on a system. If the system you're attacking is 10.10.3 or later, you won't be able to use this exploit because Apple has a fix in 10.10.3. Apple will not make the fix available to anyone on 10.9 or earlier.