7

This is related to CVE-2015-1130, a.k.a Hidden backdoor API to root privileges in Apple OS X. It appears Apple has refused to fix it in OS X 10.9 and earlier. Emil Kvarnhammar, the one who reported this vulnerability to Apple states:

Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older.

I have an OS X 10.8.5 machine and an OS X 10.9 machine. I can't upgrade either machine due to requirements outside of my and Apple's control.

In the absence of Apple patching OS before 10.10, how can we mitigate this on OS X 10.8 and OS X 10.9 machines?

Improve this question

1 Answer 1

Reset to default
2

I would say it's simply not possible.

It apparently took Apple months of effort to close this door. They specifically asked the reporter to hold long past the accepted announcement embargo period, in order to give them sufficient time to fix it before it went public. They say the reason for not back-porting it to earlier OSes is the sheer amount of effort involved.

If they can't do it, I doubt anyone else could.

If it could be even slightly mitigated by any action on your part, I'm fairly sure there would have been advice from them to that effect.

Improve this answer

You must log in to answer this question.