Vulnerability discovered that leaves popular applications on OS X exposed to attacks

Some of the most popular applications used on OS X are exposed to attacks due to a security flaw in Sparkle, the update system these applications use.

To mention some of the exposed applications, we could name uTorrent, Camtasia, VLC or Sketch.

The problem with the update system of these applications and many others, Sparkle, is that it uses an HTTP transfer protocol for updates instead of the secure HTTPS protocol for encrypted transfers. The fact that HTTP is based on plain text allows the code to be manipulated and exploited once hosted on the Mac, which would give remote control of the computer.

The good news in this story is that the latest version of Sparkle now uses only HTTPS channels. The bad news is that each application must be adapted to this protocol, a very arduous task for developers, which will not bear fruit until their respective applications are updated. The work required for each app depends on its own complexity and size. Because of this, many developers do not want to or cannot update their applications through Sparkle.

It is not known how many users may be affected by the vulnerability, but considering the affected applications, it is estimated that the figure will not be small by any means. Otherwise, the only thing that can be done is to wait.

Via Ars Technica