A vulnerability has been discovered in a tool used to patch bugs found in Apple software.
The flaw was disclosed earlier this week as part of the Month of Apple Bugs (MoAB) project. The two men behind the project, Kevin Finisterre and a former hacker known as LMH, aim to publicize bugs in Apple's OS X operating system throughout January and produce working code for any loopholes they find.
The latest vulnerability is in Application Enhancer (APE), used to apply run-time patches for published Apple flaws.
The bug allows local users to obtain root privileges - and possibly compromise a computer - by patching or replacing the APE binary code.
Software engineer Landon Fuller, who vowed to provide fixes to the flaws using the appliance, said MoAB provided only a proof-of-concept bug.
"The vulnerability is real, it is possible for a local administrator account on the computer to gain root access, without any user confirmation by replacing pieces of APE's installation," he said on his blog. "While this cannot be exploited remotely, it could be used in combination with a remote exploit to acquire escalated privileges. However, a remote exploit alone is sufficient to allow an attacker full access to your important personal data."
