Zero Day Exploit Hits Apple's OS X Extremely Critical Vulnerability Remains Unpatched Sean Michael Kerner
Apple Mac OS X users may be at risk from an "extremely critical" vulnerability that remains unpatched.
The apparent zero-day exploit comes as OS X users on the heels of recent reports that Apple Mac users are now being targeted by worm writers.
Danish security firm Secunia has rated the new flaw "extremely critical."
The vulnerability is allegedly caused by a flaw in how OS X 10.4.5 handles file association meta data found in ZIP archives. Arbitrary commands could potentially be executed automatically via Apple's Safari Web browser from a malicious site.
As of press time, Apple had not issued a patch or an advisory for the issue on its security update site. Just last week, Apple updated OS X to version 10.4.5.
Though there isn't a formal patch, there is a simple way to avoid infection. Secunia advises that Mac users disable the "Open safe files after downloading" option in Safari.
Secunia has also posted a link for users to test to see if they are at risk from the vulnerability.
The new security vulnerability comes as OS X is facing its first worms. CME-4, also known as Leap.A, appeared last week, spreading over Apple's iChat instant messaging system.
Security vendors including Symantec and Sophos reported over the weekend the discovery of OSX.Inqtana.A worm, which takes advantage of vulnerabilities in Apple's Bluetooth implementation.
"Viruses emerging for the Mac OS X platform is headline news for Apple fans, but they are currently posing far from the level of threat that Windows users face every day," said Graham Cluley, senior technology consultant for Sophos, in a statement.
"No one should panic, but this is an indication that hackers are showing an increased interest in targeting the platform."
