The developers of MacKeeper, the controversial utility software suite for OS X, have patched a critical vulnerability that could have been exploited to remotely execute arbitrary code on affected systems.
The existence of the flaw was reported last week by security researcher Braden Thomas, who published a proof-of-concept (PoC) to demonstrate his findings.
The flaw is caused due to the way MacKeeper handles custom URLs, SecureMac said in an advisory. A remote attacker can exploit the vulnerability to execute arbitrary code if he can trick the victim into visiting a specially crafted website.
If the user is already logged in when he/she clicks on the malicious link, the attacker’s code will be executed with root privileges. If victims are not logged in, they will be prompted to enter their username and password. However, SecureMac has pointed out that the text in the authentication dialog can be manipulated by the attacker, increasing the chances of the exploit being successful.
“This flaw appears to be caused by a lack of input validation by MacKeeper when executing commands using its custom URL scheme,” reads SecureMac’s advisory. “Apple’s inter-application programming guide explicitly tells developers to validate the input received from these custom URLs in order to avoid problems related to URL handling. Additionally, Apple has provided information on the importance of input validation in their Secure Coding Guide,” SecureMac clarified.
The vulnerability affects MacKeeper 3.4 and earlier, and it has been addressed with the release of version 3.4.1. MacKeeper advises users to update their installations as soon as possible. The developers noted that they patched the bug within hours after learning of its existence, and there is no evidence to suggest that the vulnerability has been exploited for malicious purposes. MacKeeper has credited SecureMac and Thomas for reporting the vulnerability.
MacKeeper was initially launched in 2010 by Zeobit and in 2013 the software was acquired by Europe-based technology investment firm Kromtech. MacKeeper announced in March that the application had been downloaded 20 million times.
Advertised as a utility suite designed to optimize, clean and secure computers running OS X, MacKeeper has been highly controversial. While there have been several positive reviews, many people have criticized the app for the way it has been advertised and some have even compared it to a piece of malware. A lawsuit filed last year alleges that MacKeeper fakes security issues in an effort to trick users into paying roughly $40 for the full version.