Looking in /etc/auto_master, which is the configuration for Autofs, the /net mou...

tmp538394722 · on April 3, 2021

Whether or not a default configuration is vulnerable is a pretty typical component of accessing a vulnerability’s severity.

Unfortunate that the author didn’t mention this.

Obviously this doesn’t excuse the bug, but it’s important to contextualize if we hope to compare relative impact and have frank discussions.

comex · on April 3, 2021

The default configuration was, in fact, vulnerable at the time. Having it be commented out by default is new.

saagarjha · on April 3, 2021

The vulnerability: https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypas...

icedchai · on April 3, 2021

I'm stilling running Mojave (10.14.x) and it is uncommented. The file dates to 2014 so I suspect it was set up with the original OS that came with this machine.