How to Fix OS X El Capitan Security Flaws: Top 10 Remediation Tips

How to Fix OS X El Capitan Security Flaws: Top 10 Remediation Tips

Abstract shapeAbstract shape
Join 27,000+ cybersecurity newsletter subscribers

The twelfth major release of Apple's flagship desktop and server operating system dropped on September 30th, 2015, bringing with it a host of new and improved features like Split View, a smarter Spotlight, Metal for Core Graphics, and under-the-hood performance improvements, among others. Alas, benefits do not without a price—in this case, myriad of security issues and exploitable vulnerabilities. The following are the top 10 of the lot followed by remediation tips.

1. Accelerate Framework Vulnerability


The Accelerate Framework consists of C APIs for vector and matrix math, digital signal processing, large number handling, and image processing. In multi-threading mode, security flaws could lead to arbitrary code execution or memory corruption and denial-of-service (DoS) when visiting a maliciously crafted website.

2. Kernal Virtual Memory Vulnerability


Apple's virtual memory kicks in when real memory (RAM) runs low, tapping into free hard disk space as a temporary memory source. A kernal issue in OS X El Capitan involving the mishandling of memory reuse could allow attackers to cause a DoS via a local, crafted application.

3. Core Audio Vulnerability


The Core Audio framework consists of a set of software interfaces for audio features in applications for OS X. Unfortunately, coreaudiod—the BSD process for this service—does not initialize an unspecified data structure, which could ultimately allow an attacker to execute arbitrary malicious code via a specially crafted application.

4. apache_mod_php Vulnerabilities

CVE-2015-0235, CVE-2015-02733

The Apache web server and PHP comes preinstalled with OS X El Capitan. Multiple vulnerabilities in apache_mod_php could allow remote attackers to execute arbitrary code by either exploiting the faulty php_date_timezone_initialize_from_hash function or the __nss_hostname_digits_dots function in glibc 2.2.

5. CFNetwork Vulnerability


CFNetwork is a framework in Core Services that provides a library of abstractions for network protocols. The flaw in question involves its inability to distinguish uppercase versus lowercase during cookie parsing, which could allow remote web servers to overwrite cookies via unspecified vectors.

6. Core Graphics Vulnerabilities 

CVE-2015-5925, CVE-2015-5926

Core Graphics—also known as Quartz—is a set of graphics-related APIs for OS X  that forms the basis of 2-D graphics rendering. In OS X El Capitan, multiple flaws in the Core Graphics component could allow remote attackers to execute arbitrary code or cause a DoS (memory corruption) via a specially crafted web site.

7. Core Text Vulnerabilities 

CVE-2015-6992, CVE-2015-6975, CVE-2015-5944

Core Text is OS X's text engine/programming interface that enables fine-grained control over text layout, formatting, and font-related operations. Multiple vulnerabilities in the latter could allow remote attackers to execute arbitrary code or cause a DoS (memory corruption) with a specially crafted font file.

8. Grand Central Dispatch Vulnerability 


Grand Central Dispatch (GCD) optimizes application support for systems with multi-core processors and other symmetric multiprocessing systems. A flaw in GCD could allow attackers to execute arbitrary code or cause a DoS (memory corruption) with a specially crafted package mishandled during dispatch calls.

9. MCX Application Restriction Vulnerability 


MCX—or Managed Clients for OS X—allows a network administrator or operator to define important preference settings on a master management server and propagate said settings automatically to new machines connecting to the network. This particular vulnerability could allow attackers to execute arbitrary code or cause a DoS (memory corruption) with a specially crafted package that is mishandled during dispatch calls.

10. Security Agent Vulnerability 


Security Agent is a process that provides the user interface for the Security Server in OS X, used primarily for requesting authentication when an application requests additional privileges. A malicious application could exploit a flaw in Security Agent to programmatically control keychain access prompts.


Upgrading to OS X El Capitan 10.11.1 can effectively remediate these vulnerabilities; that said, such security flaws in infrastructures with large, disparate OS X environments can be difficult to address. UpGuard's comprehensive vulnerability scanner can automatically scan and identify the aforementioned vulnerabilities and more through policy-driven testing. Try it out today—it's free for up to 10 nodes.



UpGuard logo in white
UpGuard free resources available for download
Learn more

Download our free ebooks and whitepapers

Insights on cybersecurity and vendor risk management.
UpGuard logo in white
eBooks, Reports & Whitepapers
UpGuard free resources available for download
UpGuard customer support teamUpGuard customer support teamUpGuard customer support team

See UpGuard In Action

Book a free, personalized onboarding call with one of our cybersecurity experts.
Abstract shapeAbstract shape

Related posts

Learn more about the latest issues in cybersecurity.
Deliver icon

Sign up to our newsletter

Get the latest curated cybersecurity news, breaches, events and updates in your inbox every week.
Abstract shapeAbstract shape
Free instant security score

How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.
  • Check icon
    Instant insights you can act on immediately
  • Check icon
    13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities
Website Security scan resultsWebsite Security scan ratingAbstract shape