In the last couple of weeks there have been a succession of major vulnerabilities revealed that have required urgent action on the part of most web services and others. This article looks at which of them need to be addressed in your Mac, and how you should go about doing so, if necessary.

Compromised certificates

The great majority of secure communication over the internet uses TLS, which in turn relies on security certificates issued by Certificate Authorities (CAs) across the world. On rare occasions, some of their certificates can become compromised, and that has recently happened with eMudhra. Their CAs issued a group of intermediate certificates with private keys, required to be unguessable, that were obvious, including one using the number 4. Those enable anyone to create their own TLS certificates that would pass as being genuine, thus allowing their malicious use.

The solution to this is for everything that relies on TLS to block those certificates issued against those compromised eMudhra intermediates, and that has already been applied to all Apple’s operating systems including macOS. But that block can’t be applied in some circumstances, as explained by Apple.

Dangers are greatest in code that relies on TLS certificates but doesn’t validate them through macOS security frameworks, of which the most significant are accessed through command tools, in particular curl. That, and others, check the validity of certificates against /etc/ssl/cert.pem instead. Although Apple intends changing that in the near future, until it does, you’ll need to remove the compromised root certificates from that manually, as explained by Apple.

How Apple is going to update /etc/ssl/cert.pem in all Macs in use is perhaps the challenge that it’s currently trying to solve. It shouldn’t prove difficult to incorporate that into macOS updates for Sequoia, Tahoe and Golden Gate, but I don’t think there’s a direct mechanism that could update it in older versions. For more recent Macs, this could perhaps be delivered by XProtect Remediator, but those still running Mojave or earlier would probably require the first new version of MRT for over four years.

There may also be some software that uses neither macOS security frameworks nor /etc/ssl/cert.pem, and that will need to be addressed separately, depending on how it checks TLS certificates. One of the lessons from previous certificate compromise events is that some software and platforms will remain vulnerable for years afterwards.

You can find a fuller account in Dan Goodin’s article on Ars Technica

PHP2Shell vulnerabilities

PHP, a scripting language used almost universally by web servers, had two critical vulnerabilities that are now being actively exploited in attacks. All public and organisational web servers should now have been updated with fixed versions of PHP. Further details are given on many sites, including this concise account from NCSC in the UK, and the original notice from the PHP Group.

As the days of running public web services on Macs have long since passed, this shouldn’t directly affect your Macs, although there may still be a few servers that remain unavailable as they await update.

UEFI firmware vulnerability

Many of those who create firmware for UEFI rely on an open source project TianoCore EDK II to build the code their UEFI runs. A memory corruption flaw has been discovered in that, making the majority of UEFI firmware vulnerable to installation of malicious payloads. You can read Dan Goodin’s account of this on Ars Technica.

The only Macs that still use UEFI firmware are those with Intel processors, and none of their firmware uses the vulnerable code, so no Macs are affected. Apple silicon Macs are among the few computers that don’t use UEFI or anything like it. However, pretty well every server in use today is at risk, hence the concern.

There’s more

Security research has accelerated rapidly as AI is harnessed to both detect and exploit vulnerabilities, often in code that has been in use for years. Don’t be surprised if there’s a long stream of serious vulnerabilities to come in the future. This makes it all the more important that you keep your Macs up to date, and increases the risk to them if you delay. Update early, and as often as possible.