Apple Mac OS X/Safari DMG vulnerability debunked

The Apple Mac OS X “com.apple.AppleDiskImageController” Memory Corruption Vulnerability” isn’t a security flaw at all, let alone a critical, highly critical, or warn-everyone-via-the-BBC type event,” Alastair J. Houghton reports for Alastair’s Place.

Houghton reports, “Now, I should say, that I’m wary of suggesting that disk images are totally safe. There’s a lot of code involved in mounting and reading/writing a disk image, and quite a bit of that runs in kernel mode. But I am pretty peeved at the way that this issue has been so widely publicised, attracting a great deal of attention for lmh and MoKB, when in actual fact there is no such security flaw.”

The Apple Mac OS X “com.apple.AppleDiskImageController” Memory Corruption Vulnerability” is nothing more than a “bug that causes a kernel panic. Not a security flaw. Not a memory corruption bug. Just a completely orderly kernel panic. There aren’t even any processor exceptions involved; the path to the panic is perfectly normal non-exceptional code using ordinary function calls,” Houghton reports.

Full article here.

[Thanks to MacDailyNews Reader “Macaday” for the heads up.]

Related articles:
BBC covers Mac OS X ‘DMG bug’ – sort of – November 27, 2006
Mac OS X/Safari DMG vulnerability reported: Turn off automatic opening of ‘safe’ files to prevent – November 21, 2006

42 Comments

  1. Wikipedia Definition of Denial of Service attack.
    * Force the victim computer(s) to reset or consume its resources such that it can no longer provide its intended service.
    * Obstruct the communication media between the intended users and the victim in such that they can no longer communicate adequately.

    I don’t see either of these happening with a simple disk image kernal panic error.

    BBC report is so full of it. FUD that is.

  2. Interesting that you raise the BBC’s journalistic integrity..

    Believe it or not, I have it in writing that they only published this news item because of the ‘smugness of Mac users over security..’

    You can be assured that was not allowed to rest.

  3. “* Force the victim computer(s) to reset”

    “I don’t see either of these happening with a simple disk image kernal panic error.”

    Doing somehting which causes the OS to panic would be a classic Denial of Service attack.

  4. Don’t be too hard on “the Beeb”. You can imagine how many hits they would get if they could work up a good article on “the virus that is going to wipe out all Macintoshes woldwide on December 25”. Think of it. The holy grail of the Mac bashers.

Reader Feedback (You DO NOT need to log in to comment. If not logged in, just provide any name you choose and an email address after typing your comment below)

This site uses Akismet to reduce spam. Learn how your comment data is processed.