The exploit targets a component used to run Apple's .dmg disk images files. The .dmg format is commonly used to compress programs for download and is similar to the .iso format used in Windows.
A security researcher using the initials 'LMH' posted details about the vulnerability as part of the Month of Kernel Bugs project.
The author claimed that the exploit could easily be executed in Apple's Safari web browser through a specially crafted .dmg file launched when a user visits a web page.
According to LMH, the threat can be mitigated in Safari by disabling a setting in the browser's preference panel that reads 'Open 'safe' files after downloading.'
Disabling the setting will prevent .dmg files, images, movies and PDF files from automatically opening after they have been downloaded.
Security firm Secunia rates the vulnerability as 'highly critical', its second-highest threat level. It is the highest alert level given to a Mac OS X vulnerability since the publication of an official Apple security update in early October.
The Month of Kernel Bugs project has vowed to post new proof-of-concept or exploit code every day for the entire month of November.
Apple did not respond to a request for comment.
- 'Macarena' virus hits Apple Mac OS X
- New Apple AirPort vulnerability surfaces
- Apple fixes random MacBook shutdowns
- Apple iPhone launch rumours grow
- Aircraft iPod connectors hit turbulence
Newbies will be thrown in with the big boys on Sanhok as Kar98 fodder
Data is the perfect intersection of logic and emotion
Support for RTX Technology and new version of GPU Boost algorithm coming in next-gen Nvidia GPUs
Is Sony's Xperia XZ2 Compact a big step forward against last year's XZ1 Compact?