Evernote fixes macOS app bug that allowed remote code execution

guest · Apr 17, 2019

Evernote fixes macOS app bug that allowed remote code execution
April 17, 2019
https://techcrunch.com/2019/04/17/evernote-macos-bug/

Dhiraj Mishra, a security researcher based in Dubai, reported the bug to Evernote on March 17. In a blog post showing his proof-of-concept, Mishra showed TechCrunch that a user only had to click a link masked as a web address, which would open a locally stored app or file unhindered and without warning.

Evernote spokesperson Shelby Busen confirmed the bug had been fixed, and said the company “appreciates” the contributions from security researchers.
MITRE, the vulnerability database keeper, issued an advisory under CVE-2019-10038.

The bug could allow an attacker to remotely run malicious commands on any macOS computer with Evernote installed. Since the fix went into effect, Evernote now warns users when they click a link that opens a file on their Mac.
Click to expand...

Log in or Sign up

Evernote fixes macOS app bug that allowed remote code execution

guest Guest

Log in or Sign up

Evernote fixes macOS app bug that allowed remote code execution

guest Guest

Useful Searches