Security Experts:

Connect with us

Hi, what are you looking for?



MacKeeper Patches Serious Remote Code Execution Flaw

The developers of MacKeeper, the controversial utility software suite for OS X, have patched a critical vulnerability that could have been exploited to remotely execute arbitrary code on affected systems.

The developers of MacKeeper, the controversial utility software suite for OS X, have patched a critical vulnerability that could have been exploited to remotely execute arbitrary code on affected systems.

The existence of the flaw was reported last week by security researcher Braden Thomas, who published a proof-of-concept (PoC) to demonstrate his findings.

The flaw is caused due to the way MacKeeper handles custom URLs, SecureMac said in an advisory. A remote attacker can exploit the vulnerability to execute arbitrary code if he can trick the victim into visiting a specially crafted website.

If the user is already logged in when he/she clicks on the malicious link, the attacker’s code will be executed with root privileges. If victims are not logged in, they will be prompted to enter their username and password. However, SecureMac has pointed out that the text in the authentication dialog can be manipulated by the attacker, increasing the chances of the exploit being successful.

“This flaw appears to be caused by a lack of input validation by MacKeeper when executing commands using its custom URL scheme,” reads SecureMac’s advisory. “Apple’s inter-application programming guide explicitly tells developers to validate the input received from these custom URLs in order to avoid problems related to URL handling. Additionally, Apple has provided information on the importance of input validation in their Secure Coding Guide,” SecureMac clarified.

The vulnerability affects MacKeeper 3.4 and earlier, and it has been addressed with the release of version 3.4.1. MacKeeper advises users to update their installations as soon as possible. The developers noted that they patched the bug within hours after learning of its existence, and there is no evidence to suggest that the vulnerability has been exploited for malicious purposes. MacKeeper has credited SecureMac and Thomas for reporting the vulnerability.

MacKeeper was initially launched in 2010 by Zeobit and in 2013 the software was acquired by Europe-based technology investment firm Kromtech. MacKeeper announced in March that the application had been downloaded 20 million times.

Advertised as a utility suite designed to optimize, clean and secure computers running OS X, MacKeeper has been highly controversial. While there have been several positive reviews, many people have criticized the app for the way it has been advertised and some have even compared it to a piece of malware. A lawsuit filed last year alleges that MacKeeper fakes security issues in an effort to trick users into paying roughly $40 for the full version.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.