OSX.Exploit.Launchd: A false security flag

[rusty charly]

Earlier today, Symantec issued an alert regarding a "new" Mac OS X trojan dubbed "OSX.Exploit.Launchd," and alleged Trojan horse that exploits the Apple Mac OS X LaunchD Local Format String Vulnerability.

The problem is there is no such "trojan" in the wild, nor has anyone's machine been exploited. In fact, Symantec's "discovery" of this vulnerability only came about because Apple released Mac OS X 10.4.7, which precludes the exploit by patching the Mac OS X launchd process.

The vulnerability was hence published by SecurityFocus (CVE-2006-1471), which called the "trojan" to Symantec's attention.

Oddly enough, Symantec's page describing the "trojan" does not even mention that applying the Mac OS X 10.4.7 update will plug this security hole, but instead offers some strange workarounds like: "Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files" and "Turn off and remove unneeded services. "

http://www.macfixit.com/article.php?story=20060630141843699

To recap, there is no threatening exploit in the wild, and the vulnerability has been patched in Mac OS X 10.4.7.

[Wrinkle_In_Time]

1. Yep, too much F.U.D. and not enough info in Symantec's note

1) An attacker must already have a local account on the target computer, so the vast majority of computers would not be at risk. It's not clear if a server using some form of directory authentication (LDAP, AD) would be vulnerable either, since only local accounts are mentioned in the 10.4.7 release notes and on Symantec's site.

2) Symantec's direction to block .vbs, .bat, .exe, .pif and .scr e-mail file attachments is misleading, as these files cannot harm a Mac. It is a good idea to block those so that a Mac can't be a "carrier" of an infection that strikes a Windows user. E-mail file attachments have nothing to do with the launchd vulnerability.

EDIT: typo