A hot potato: A security researcher found that Apple has merely partially fixed a security flaw affecting all versions of macOS. The company tried to fix the problem silently only failed to do then, leaving millions of Macs vulnerable to remote lawmaking execution without any alarm or prompt.

Apple tree has been doing a practiced task of patching various macOS security vulnerabilities as of belatedly, but at that place'southward at least one that is proving harder to prepare than the Cupertino giant had anticipated.

According to contained researcher Park Minchan, the zero-day flaw is present in all versions of macOS -- including macOS Big Sur -- and allows a malicious actor to execute capricious lawmaking remotely with the help of some elementary files embedded in emails received via Apple Mail or whatever other email app.

Minchan says this is possible due to a issues in how macOS handles Internet location (inetloc) files which causes it to run any commands embedded inside. Unremarkably, these are organisation-wide bookmarks used to open online resources or local files, merely in this case, they tin be leveraged past an attacker to execute malicious code without any warning or prompts beingness shown to the user on the target Mac.

This can be done by changing the prefacing link in an inetloc file with "file://," and all it takes to perform the exploit is one click from the user. Apple did effort to patch the flaw on macOS Large Sur, merely it did and then silently without assigning information technology a CVE and overlooked the fact that using "File://" or "fIle://" (simply mangling the value) tin work merely also equally "file://."

Minchan notified the visitor most the upshot but has notwithstanding to hear back. In the concurrently, the only affair you lot tin exercise is to refrain from opening e-mail attachments that have the "inetloc" extension.