'Huge' Number of Mac Apps Open to Hijacking From Sparkle Updater Vulnerability
A pair of vulnerabilities in the framework that some Mac apps use to receive automatic updates leaves them open to man-in-the-middle attacks, according to a report from Ars Technica covering a security flaw that was first discovered by a security researcher named Radek in late January.
Apps that use a vulnerable version of Sparkle and an unencrypted HTTP channel for server updates are at risk of being hijacked to transmit malicious code to end users. The Sparkle framework is used by apps outside of the Mac App Store to facilitate automatic software updates.
Some of the affected apps are widely downloaded titles like Camtasia, Duet Display, uTorrent, and Sketch. A proof of concept attack was shared by Simone Margaritelli using an older version of VLC, which was recently updated to patch the flaw. The vulnerabilities were tested on both OS X Yosemite and the most recent version of OS X El Capitan.
A "huge" number of apps are said to be at risk, but as
Ars Technica points out, it is difficult to tell exactly which apps that use Sparkle are open to attack. GitHub users have
compiled a list of apps that use Sparkle, but not all use the vulnerable version and not all transfer data over non-secured HTTP channels.
Apps downloaded through the Mac App Store are not affected as OS X's built in software update mechanism does not use Sparkle.
Sparkle has released a fix in the newest version of the Sparkle Updater, but it will take some time for Mac apps to implement the patched framework. Ars Technica recommends concerned users with potentially vulnerable apps installed avoid using unsecured Wi-Fi networks or do so only via a VPN.
Popular Stories
Apple's "It's Glowtime" event kicks off today at 10:00 a.m. Pacific Time, where we're expecting to see the iPhone 16 lineup and some updated Apple Watch and AirPods models unveiled, and perhaps some other announcements. Apple is providing a live video stream on its website, on YouTube, and in the company's TV app across various platforms. We will also be updating this article with live blog...
Apple today announced the iPhone 16 Pro and iPhone 16 Pro Max—its latest flagship smartphones—featuring larger displays, an all-new Camera Control button, and the A18 Pro chip. The iPhone 16 Pro has a 6.3-inch display, while the iPhone 16 Pro Max features a 6.9-inch display—the biggest iPhone display ever. The borders around the display are the thinnest of any Apple device. The...
Apple is "shaking up its color palette" for its iPhone 16 lineup this year, according to well-connected Bloomberg reporter Mark Gurman. Early iPhone 16 Pro dummy models via Sonny Dickson According to Gurman, the iPhone 16 Pro models will come in a Gold Titanium to replace Blue Titanium, while the Black, White, and Natural Titanium options that debuted with the iPhone 15 Pro will remain...
Apple's next-generation iPhone 16 series is expected to launch on September 20 and will compete in a quickly evolving smartphone market, and with some notable upgrades rumored, the new models could see price changes compared to previous years. Successive iPhone models always come with new features and hardware upgrades, but Apple typically does not increase the retail prices as a result....
Apple today announced that the AirPods Max are being updated with a USB-C charging port and new color options, including Midnight, Blue, Purple, Orange, and Starlight. In addition, Apple said the AirPods Max are gaining support for Personalized Spatial Audio with the upcoming iOS 18 software update. The updated AirPods Max will be available to pre-order for $549 starting today, and the...
macOS Sequoia will be one of the earliest new macOS launches in over a decade, likely releasing within as little as just a week. Internal Apple documentation obtained by MacRumors suggests that macOS 15.0 Sequoia will be officially released to the public by mid-September. The release dates of major macOS updates in recent years are listed below: OS X 10.9 (Mavericks) – October 22,...
Apple at its event today announced the Apple Watch Series 10, featuring a wide-angle OLED display that is larger than the Apple Watch Ultra, with the company describing it as the "biggest display and thinnest design ever." The Series 10 is 9.7mm thick, which is nearly 10% thinner than Series 9, and it weighs 20% less than the Stainless Steel Series 9. The Aluminum cases also weigh up to 10%...
