Zero click vulnerability in Apple’s macOS Mail

#1

Post by jviide » Thu, Apr 01, 2021, 7:03 PM UTC

Zero click vulnerability in Apple’s macOS Mail
mikko-kenttala.medium.com

Re: Zero click vulnerability in Apple’s macOS Mail

#2

Post by threatofrain » Thu, Apr 01, 2021, 8:44 PM UTC

> 2020–05–16: Issue found

> 2020–05–24: PoC done and reported to Apple

> 2020–06–04: Catalina 10.15.6 Beta 4 with [hotfix released]

> 2020–07–15: Catalina 10.15.6 Update with hotfix released

Re: Zero click vulnerability in Apple’s macOS Mail

#3

Post by _alex_ » Thu, Apr 01, 2021, 8:48 PM UTC

That's gonna be devastating to the three people who use Mail.app

Re: Zero click vulnerability in Apple’s macOS Mail

#4

Post by lehi » Thu, Apr 01, 2021, 8:51 PM UTC

threatofrain wrote: post #2

> 2020–05–16: Issue found > 2020–05–24: PoC done and reported to Apple > 2020–06–04: Catalina 10.15.6 Beta 4 with [hotfix released] > 2020–07–15: Catalina 10.15.6 Update with hotfix released

> 2021–03–30: Bug Bounty is still being evaluated

Re: Zero click vulnerability in Apple’s macOS Mail

#5

Post by politician » Thu, Apr 01, 2021, 8:53 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

With the Mail.app pegging their CPU to 100%, those three people are unlikely to notice. Frankly, it's unlikely for the attacker to be able to do anything either, aside from force-terminating Mail.app.

(Disclaimer: I want to like Mail.app, but I don't need another fan in my office.)

Re: Zero click vulnerability in Apple’s macOS Mail

#6

Post by ratww » Thu, Apr 01, 2021, 8:55 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

That's not what the statistics say:

https://emailclientmarketshare.com

Re: Zero click vulnerability in Apple’s macOS Mail

#7

Post by kps » Thu, Apr 01, 2021, 8:56 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

What are the options for those who foolishly installed an OS version later than Snow Leopard and can't run Eudora?

Re: Zero click vulnerability in Apple’s macOS Mail

#8

Post by wahern » Thu, Apr 01, 2021, 8:58 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

The feature accretion and default layout redesigns have increasingly become a headache, but Mail.app still seems like the spiritual successor to Eudora, which may have remained the most popular desktop e-mail GUI if Microsoft hadn't leveraged their monopoly in the business workstation and LAN markets to push the adoption of Outlook. I use mutt for personal e-mail, but prefer Mail.app for work.

Re: Zero click vulnerability in Apple’s macOS Mail

#9

Post by codezero » Thu, Apr 01, 2021, 9:00 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

It’s my main email client, what’s wrong with it?

Re: Zero click vulnerability in Apple’s macOS Mail

#10

Post by sneak » Thu, Apr 01, 2021, 9:00 PM UTC

_alex_ wrote: post #3

That's gonna be devastating to the three people who use Mail.app

I am one of those three people. Do you know of any decent gui IMAP clients?